56e2408bde8dfac5b2ba067dad62c0a24cb0b834116e12e9e26a7ee5bfc65b1a

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
23-08-2023 00:34

Target

56e2408bde8dfac5b2ba067dad62c0a24cb0b834116e12e9e26a7ee5bfc65b1a.dll
Size

51KB
MD5

7cccd0c79d7120b53ad026a6f70925fa
SHA1

f184d02c097af56db8eeb05560b0a47344929f94
SHA256

56e2408bde8dfac5b2ba067dad62c0a24cb0b834116e12e9e26a7ee5bfc65b1a
SHA512

71ca4cd9948b8fc258dcb6c6cbd0643966b84db7161163ae148746210793c9f7cc68752f2647ef9af297e9813a501cdb8a53ff90c1069cec90da288f1df83d10
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLeJYH5:1dWubF3n9S91BF3fboqJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1368	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 212 wrote to memory of 1368	212	rundll32.exe	80
PID 212 wrote to memory of 1368	212	rundll32.exe	80
PID 212 wrote to memory of 1368	212	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\56e2408bde8dfac5b2ba067dad62c0a24cb0b834116e12e9e26a7ee5bfc65b1a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\56e2408bde8dfac5b2ba067dad62c0a24cb0b834116e12e9e26a7ee5bfc65b1a.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1368