b391ba3192bff53e9763a8a85573afa106a195aeb1efe6ce89f125b31ce354ff

Analysis

max time kernel
134s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
22-09-2023 05:14

Target

b391ba3192bff53e9763a8a85573afa106a195aeb1efe6ce89f125b31ce354ff.dll
Size

50KB
MD5

25d3fe49679f55972b58a98044e9d2c9
SHA1

3730b913d733706975df85df9ce65007b6ba1142
SHA256

b391ba3192bff53e9763a8a85573afa106a195aeb1efe6ce89f125b31ce354ff
SHA512

81034f46a99013c4c54c82d31d84357c4430e7dd039673be62397f47e92cd3b3d1ea428bf2873353f281253b480dd5806d4aa0c23c0c0d1bcc78fd27b3234ba0
SSDEEP

1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5zJYH:W5ReWjTrW9rNPgYoRJYH

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
216	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 216	2904	rundll32.exe	82
PID 2904 wrote to memory of 216	2904	rundll32.exe	82
PID 2904 wrote to memory of 216	2904	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b391ba3192bff53e9763a8a85573afa106a195aeb1efe6ce89f125b31ce354ff.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b391ba3192bff53e9763a8a85573afa106a195aeb1efe6ce89f125b31ce354ff.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:216