963ab28f2437c52b6f2c72828013bd0736b0e75bdfe2d0855064e8b2fa5406a9

Analysis

max time kernel
138s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 04:58

Target

963ab28f2437c52b6f2c72828013bd0736b0e75bdfe2d0855064e8b2fa5406a9.dll
Size

51KB
MD5

2ed10c1ff9164692f5315c8f21f4f18b
SHA1

5d5909b54ece23c25a686640dded5f38f1153cc6
SHA256

963ab28f2437c52b6f2c72828013bd0736b0e75bdfe2d0855064e8b2fa5406a9
SHA512

3abcf09aa961a2e260540475870fe3386dc141a9a9a010d1fe836dff725db680ee5c81bec66865bd7722cf87a09c13f5fa2ec7696d5d616a11a29f1d3e421d57
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLtJYH5:1dWubF3n9S91BF3fboxJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4964	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 4964	4192	rundll32.exe	83
PID 4192 wrote to memory of 4964	4192	rundll32.exe	83
PID 4192 wrote to memory of 4964	4192	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\963ab28f2437c52b6f2c72828013bd0736b0e75bdfe2d0855064e8b2fa5406a9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\963ab28f2437c52b6f2c72828013bd0736b0e75bdfe2d0855064e8b2fa5406a9.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4964