56b5b660ddce818fcb05217443084ca40c17bbd1f0fbf5b1742e35815ef670e2

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
23/08/2023, 00:00

Target

56b5b660ddce818fcb05217443084ca40c17bbd1f0fbf5b1742e35815ef670e2.dll
Size

899KB
MD5

c3bffd7954cc5997c6ec267671ed173e
SHA1

aa66efc4214efdb91c1a440eb675acb3c121b971
SHA256

56b5b660ddce818fcb05217443084ca40c17bbd1f0fbf5b1742e35815ef670e2
SHA512

619921840ffe891d4c51ea96fd8a2f6679bd25f37997285e69632e3f6ad99cc6c654acc7a69b88bed9b5dd127c6d9c2864de0ff752ed7fae0a0a6baae0da0258
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXX:7wqd87VX

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2120	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 2120	2640	rundll32.exe	28
PID 2640 wrote to memory of 2120	2640	rundll32.exe	28
PID 2640 wrote to memory of 2120	2640	rundll32.exe	28
PID 2640 wrote to memory of 2120	2640	rundll32.exe	28
PID 2640 wrote to memory of 2120	2640	rundll32.exe	28
PID 2640 wrote to memory of 2120	2640	rundll32.exe	28
PID 2640 wrote to memory of 2120	2640	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\56b5b660ddce818fcb05217443084ca40c17bbd1f0fbf5b1742e35815ef670e2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\56b5b660ddce818fcb05217443084ca40c17bbd1f0fbf5b1742e35815ef670e2.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2120