e22b3cb6a3a6c73862f443ec871d04c660892e48640ff2a59ca4342bd9b9ecfd

Analysis

max time kernel
139s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2023, 03:27

Target

e22b3cb6a3a6c73862f443ec871d04c660892e48640ff2a59ca4342bd9b9ecfd.dll
Size

899KB
MD5

979962cf3be619fe1e3c41b6aa800fcc
SHA1

4ab6dfd2b5b297732b8fc2028db42f26a193946b
SHA256

e22b3cb6a3a6c73862f443ec871d04c660892e48640ff2a59ca4342bd9b9ecfd
SHA512

9c9342923f1784f1b6be84cbbf7ba0f1a9be8315b3b5fd4914f7b32e9b001cb8399c4339d3a6083d876009a5a886296f7e0ee9c30d5f2ae7b47bf5f2f2b25c23
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXE:7wqd87VE

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1456	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4240 wrote to memory of 1456	4240	rundll32.exe	82
PID 4240 wrote to memory of 1456	4240	rundll32.exe	82
PID 4240 wrote to memory of 1456	4240	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e22b3cb6a3a6c73862f443ec871d04c660892e48640ff2a59ca4342bd9b9ecfd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e22b3cb6a3a6c73862f443ec871d04c660892e48640ff2a59ca4342bd9b9ecfd.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1456