b391ba3192bff53e9763a8a85573afa106a195aeb1efe6ce89f125b31ce354ff

Analysis

max time kernel
152s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 05:22

Target

b391ba3192bff53e9763a8a85573afa106a195aeb1efe6ce89f125b31ce354ff.dll
Size

50KB
MD5

25d3fe49679f55972b58a98044e9d2c9
SHA1

3730b913d733706975df85df9ce65007b6ba1142
SHA256

b391ba3192bff53e9763a8a85573afa106a195aeb1efe6ce89f125b31ce354ff
SHA512

81034f46a99013c4c54c82d31d84357c4430e7dd039673be62397f47e92cd3b3d1ea428bf2873353f281253b480dd5806d4aa0c23c0c0d1bcc78fd27b3234ba0
SSDEEP

1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5zJYH:W5ReWjTrW9rNPgYoRJYH

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4408	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 4408	2248	rundll32.exe	85
PID 2248 wrote to memory of 4408	2248	rundll32.exe	85
PID 2248 wrote to memory of 4408	2248	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b391ba3192bff53e9763a8a85573afa106a195aeb1efe6ce89f125b31ce354ff.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b391ba3192bff53e9763a8a85573afa106a195aeb1efe6ce89f125b31ce354ff.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4408