221bf5b926b760ee758a3f7bbf9ebfbe5c9224f46b13f86d10e332d97e387ffb

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2023, 03:46

Target

221bf5b926b760ee758a3f7bbf9ebfbe5c9224f46b13f86d10e332d97e387ffb.dll
Size

51KB
MD5

14747330907ce09eb75702a5fbded523
SHA1

6724a9f893b60220ab1d37a422cdeea2760496d2
SHA256

221bf5b926b760ee758a3f7bbf9ebfbe5c9224f46b13f86d10e332d97e387ffb
SHA512

7d3b3abca9268bae6cbbdf55be9ef6390f65e2afcbf60f44c914077ec6c16796c650610081bc9c50402e30c4f138027515366ba437bc0ddae107b0504e5aa397
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL+IJYH5:1dWubF3n9S91BF3fbo/JYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3864	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 3864	1228	rundll32.exe	83
PID 1228 wrote to memory of 3864	1228	rundll32.exe	83
PID 1228 wrote to memory of 3864	1228	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\221bf5b926b760ee758a3f7bbf9ebfbe5c9224f46b13f86d10e332d97e387ffb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\221bf5b926b760ee758a3f7bbf9ebfbe5c9224f46b13f86d10e332d97e387ffb.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3864