b4d4dd5d5b977f8611624da67a8c5500b13aa81906795a2bc20ece98955ef09e

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
27-08-2023 23:54

Target

b4d4dd5d5b977f8611624da67a8c5500b13aa81906795a2bc20ece98955ef09e.dll
Size

51KB
MD5

63fc81e0d15dd78f7403b8ea61f83a49
SHA1

2003b548bf3481184d7c2cdea35e01316635987a
SHA256

b4d4dd5d5b977f8611624da67a8c5500b13aa81906795a2bc20ece98955ef09e
SHA512

ef62a92a8e7672ddd62f76a8162ba675a8581928c16c83c292159277b4c58cb5f90fbaae5b8885b0de491bda2a60b2f37ed1d39f17949b2ce76a3b8167befcb2
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLOJYH5:1dWubF3n9S91BF3fboCJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2792	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2792	3020	rundll32.exe	28
PID 3020 wrote to memory of 2792	3020	rundll32.exe	28
PID 3020 wrote to memory of 2792	3020	rundll32.exe	28
PID 3020 wrote to memory of 2792	3020	rundll32.exe	28
PID 3020 wrote to memory of 2792	3020	rundll32.exe	28
PID 3020 wrote to memory of 2792	3020	rundll32.exe	28
PID 3020 wrote to memory of 2792	3020	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4d4dd5d5b977f8611624da67a8c5500b13aa81906795a2bc20ece98955ef09e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4d4dd5d5b977f8611624da67a8c5500b13aa81906795a2bc20ece98955ef09e.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2792