4e1498a36f0c20188d47d81ad03f27d0ac8e867c8a96deb7a9985e4bef48fc57

Analysis

max time kernel
142s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2023, 22:56

Target

4e1498a36f0c20188d47d81ad03f27d0ac8e867c8a96deb7a9985e4bef48fc57.dll
Size

51KB
MD5

fe8bb01d40161d89716496d95e8aae0d
SHA1

dac3643f0ce1c48aa55fd63cd37a4fa851859029
SHA256

4e1498a36f0c20188d47d81ad03f27d0ac8e867c8a96deb7a9985e4bef48fc57
SHA512

da932af9715fbe91698615dd9d894f54b51d88cb1da6e6f53aa0fd74518c0e6ffd0571e379396f90454660b995969f841f5f0e86b8a17683e2a4650afbc94a4d
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLHJYH5:1dWubF3n9S91BF3fboDJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3912	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 3912	1756	rundll32.exe	69
PID 1756 wrote to memory of 3912	1756	rundll32.exe	69
PID 1756 wrote to memory of 3912	1756	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e1498a36f0c20188d47d81ad03f27d0ac8e867c8a96deb7a9985e4bef48fc57.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e1498a36f0c20188d47d81ad03f27d0ac8e867c8a96deb7a9985e4bef48fc57.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3912