b36def75cd7409c2dac2e03e5f19531968cc3945125bbac371fc743431050b93

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2023, 19:01

Target

b36def75cd7409c2dac2e03e5f19531968cc3945125bbac371fc743431050b93.dll
Size

899KB
MD5

d9a83889901f1aeb8f86387af866fc4e
SHA1

8a8b9075033daa0aed9470810081977288b29f07
SHA256

b36def75cd7409c2dac2e03e5f19531968cc3945125bbac371fc743431050b93
SHA512

7a440134b1591f200a7ed9c1b9abafc9845596f03b7ea778dbf919bd52551a5e569dbf740500b6114db5e91298d650569122e9a57b88f1b114a3a13dda433d9d
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXy:7wqd87Vy

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1280	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 1280	4392	rundll32.exe	84
PID 4392 wrote to memory of 1280	4392	rundll32.exe	84
PID 4392 wrote to memory of 1280	4392	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b36def75cd7409c2dac2e03e5f19531968cc3945125bbac371fc743431050b93.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b36def75cd7409c2dac2e03e5f19531968cc3945125bbac371fc743431050b93.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1280