0ebb01bb7794ca8efb104db8701d578e40bda3787cc786f6c23f1b8b6db03ff6

Analysis

max time kernel
140s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 09:52

Target

0ebb01bb7794ca8efb104db8701d578e40bda3787cc786f6c23f1b8b6db03ff6.dll
Size

51KB
MD5

1c4e2d60e9178818c17042ee1cecb436
SHA1

0b1da5a6490833892613bacd21a862daf31088b0
SHA256

0ebb01bb7794ca8efb104db8701d578e40bda3787cc786f6c23f1b8b6db03ff6
SHA512

d3d53f414194a73c04f635d53570f32f7e1efbe7fbba26cb33a2748097af477ef7c331abd3d75ebe344437b3c3fe8efa8c1d40d8b7091e5faee3a4bb9a96ebe7
SSDEEP

768:3Er7XR1M6t6FikUE58ozVOB+6QcXn0cE5Y18BtrEZJjuSkwFOBezhsAMC6Hh4:3EXXM2HEhzVWKtrEZFxFOBipMC6H

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1516	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 1516	3408	rundll32.exe	84
PID 3408 wrote to memory of 1516	3408	rundll32.exe	84
PID 3408 wrote to memory of 1516	3408	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ebb01bb7794ca8efb104db8701d578e40bda3787cc786f6c23f1b8b6db03ff6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ebb01bb7794ca8efb104db8701d578e40bda3787cc786f6c23f1b8b6db03ff6.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1516

memory/1516-0-0x0000000074940000-0x0000000074950000-memory.dmp

Filesize
64KB

Download