37bbbea7f5725e0ed206a0ab3fd32dbd76f56b0db7e13abeb27f7aec877079fa

Analysis

max time kernel
140s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
18/09/2023, 06:35

Target

37bbbea7f5725e0ed206a0ab3fd32dbd76f56b0db7e13abeb27f7aec877079fa.dll
Size

51KB
MD5

b3bdc23bd385f4a6cc26893e645c6960
SHA1

2e5b86fe120e0d351e5066857b419e387bbebb95
SHA256

37bbbea7f5725e0ed206a0ab3fd32dbd76f56b0db7e13abeb27f7aec877079fa
SHA512

78ffa43eb5427384d206435da8be211899e3a47ddc9bf45b53ab01845c0aea164afd927e5753bdb99b35ea768bd56a5008789e7d8cf5efae1dd029b3c8a2ce8f
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLEJYH5:1dWubF3n9S91BF3fbooJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
228	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 228	3032	rundll32.exe	80
PID 3032 wrote to memory of 228	3032	rundll32.exe	80
PID 3032 wrote to memory of 228	3032	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\37bbbea7f5725e0ed206a0ab3fd32dbd76f56b0db7e13abeb27f7aec877079fa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\37bbbea7f5725e0ed206a0ab3fd32dbd76f56b0db7e13abeb27f7aec877079fa.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:228