40a5e28149692294dea15ec549e541e5e4ff21c0b4eace28879fb07bc762ba08

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
28/08/2023, 04:41

Target

40a5e28149692294dea15ec549e541e5e4ff21c0b4eace28879fb07bc762ba08.dll
Size

50KB
MD5

b8007e97d49ca55ea27d2566baf713a0
SHA1

81928837d27651c4389ee069e1119b4e814099b9
SHA256

40a5e28149692294dea15ec549e541e5e4ff21c0b4eace28879fb07bc762ba08
SHA512

12c00fafd29515dd51182f1e5d839a71f1d32d7b647ee6b46fdf66b063e129358a0bc0d0afff437cd15356b3ab11044866e981119bd89d6946c675326d61baab
SSDEEP

1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5NJYH:W5ReWjTrW9rNPgYoTJYH

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2564	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2564	2152	rundll32.exe	80
PID 2152 wrote to memory of 2564	2152	rundll32.exe	80
PID 2152 wrote to memory of 2564	2152	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\40a5e28149692294dea15ec549e541e5e4ff21c0b4eace28879fb07bc762ba08.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\40a5e28149692294dea15ec549e541e5e4ff21c0b4eace28879fb07bc762ba08.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2564