681fd963a13023988647eacb5ad89592bbd5a761343f2b7899e9c39a65ce889e

Analysis

max time kernel
134s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
28/08/2023, 03:45

Target

681fd963a13023988647eacb5ad89592bbd5a761343f2b7899e9c39a65ce889e.dll
Size

50KB
MD5

08613bcf7a170b7319e6d278be6f1101
SHA1

2933339b520e422b34492d46f897aa6832dd66a3
SHA256

681fd963a13023988647eacb5ad89592bbd5a761343f2b7899e9c39a65ce889e
SHA512

40542c60f8d9935f97b99adf52f4f97c76aa891c52063221f046a02cfd629eaf1957c5240420c1e6d38f340450a54f25d2724aae25ca7240f742543859ac3033
SSDEEP

1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5wJYH:W5ReWjTrW9rNPgYoqJYH

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
916	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 916	4912	rundll32.exe	80
PID 4912 wrote to memory of 916	4912	rundll32.exe	80
PID 4912 wrote to memory of 916	4912	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\681fd963a13023988647eacb5ad89592bbd5a761343f2b7899e9c39a65ce889e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\681fd963a13023988647eacb5ad89592bbd5a761343f2b7899e9c39a65ce889e.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:916