56f58d630fa00229922224a35b03090c836ad990ef1d9920a5871ece9dd0cdaa

Analysis

max time kernel
139s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 22:03

Target

56f58d630fa00229922224a35b03090c836ad990ef1d9920a5871ece9dd0cdaa.dll
Size

51KB
MD5

47a235e0881fa41a81b0f84e032be79d
SHA1

44a27f37a55ab25743afe20973aaf0bbb2b55612
SHA256

56f58d630fa00229922224a35b03090c836ad990ef1d9920a5871ece9dd0cdaa
SHA512

7d47f79bcd84ee192f3b5549645e2f2afed4fa2d37e05e50ef165f15a63f8419ee7b6dd96d50d3c2ff91088e25d995d53a3586a067b791875c964ede53e4f3b9
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLoJYH5:1dWubF3n9S91BF3fbocJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3628	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 3628	4908	rundll32.exe	81
PID 4908 wrote to memory of 3628	4908	rundll32.exe	81
PID 4908 wrote to memory of 3628	4908	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\56f58d630fa00229922224a35b03090c836ad990ef1d9920a5871ece9dd0cdaa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\56f58d630fa00229922224a35b03090c836ad990ef1d9920a5871ece9dd0cdaa.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3628