20b4880a4d904897d1f1007b272c3b0cd7be93c72f6d6809d580f9c808d68858

Analysis

max time kernel
199s
max time network
220s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2023 15:32

Target

20b4880a4d904897d1f1007b272c3b0cd7be93c72f6d6809d580f9c808d68858.dll
Size

51KB
MD5

9c3a0dab71659cefc31d345f002c9997
SHA1

cb55477b6141882fbb17fc98e04c14ea7ccbe89f
SHA256

20b4880a4d904897d1f1007b272c3b0cd7be93c72f6d6809d580f9c808d68858
SHA512

27480a773d0a3c56fcc6eac7b36d5bc65854c4b1fb1aa54e2a35eec57656fbe8afc388a482d1c21c21d7abf1a66a7b90ba43dff46ce897aac20e2e46e23217e8
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLhJYH5:1dWubF3n9S91BF3fbolJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4100	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3572 wrote to memory of 4100	3572	rundll32.exe	84
PID 3572 wrote to memory of 4100	3572	rundll32.exe	84
PID 3572 wrote to memory of 4100	3572	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\20b4880a4d904897d1f1007b272c3b0cd7be93c72f6d6809d580f9c808d68858.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\20b4880a4d904897d1f1007b272c3b0cd7be93c72f6d6809d580f9c808d68858.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4100