13787cca6f6ee26aed14cb8a957271035016b3b4d95220c5a62bfd74e7fc1a0a

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 04:52

Target

13787cca6f6ee26aed14cb8a957271035016b3b4d95220c5a62bfd74e7fc1a0a.dll
Size

51KB
MD5

77d5f6ad16ebf47dc7802c3b6f682750
SHA1

17b3a18b805e267f9650bbb9cdf33d6b8cdee7f5
SHA256

13787cca6f6ee26aed14cb8a957271035016b3b4d95220c5a62bfd74e7fc1a0a
SHA512

0dbfcb5a948e92fddd910d97d8f83fa161496ee321a73dc79d915427102c14e73242366db5fa9c2a1df6e75ccf0f4897147b538137104f22dd1a28a8343152d7
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLnJYH5:1dWubF3n9S91BF3fborJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5100	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3080 wrote to memory of 5100	3080	rundll32.exe	87
PID 3080 wrote to memory of 5100	3080	rundll32.exe	87
PID 3080 wrote to memory of 5100	3080	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\13787cca6f6ee26aed14cb8a957271035016b3b4d95220c5a62bfd74e7fc1a0a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\13787cca6f6ee26aed14cb8a957271035016b3b4d95220c5a62bfd74e7fc1a0a.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:5100