1b33347e85229a9be28205436548e3de45c1f25a5b6a32b77be4af94af5e9534

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
21/11/2023, 00:36

Target

1b33347e85229a9be28205436548e3de45c1f25a5b6a32b77be4af94af5e9534.dll
Size

51KB
MD5

45ab20ee6a91f361a6f04768a9957d1d
SHA1

20c01e95698eb24b0b091bcf313775edf88b0c79
SHA256

1b33347e85229a9be28205436548e3de45c1f25a5b6a32b77be4af94af5e9534
SHA512

81235bb36333b88aa7c741f00fabf121b5d953e31823f1b78de6d74675f336d46fa7a5f79bd83d0c97357625e7c53078f4bef6011a17c8c86efe0f6f0ff65fc8
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLoJYH5:1dWubF3n9S91BF3fbosJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1444	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 1444	2136	rundll32.exe	28
PID 2136 wrote to memory of 1444	2136	rundll32.exe	28
PID 2136 wrote to memory of 1444	2136	rundll32.exe	28
PID 2136 wrote to memory of 1444	2136	rundll32.exe	28
PID 2136 wrote to memory of 1444	2136	rundll32.exe	28
PID 2136 wrote to memory of 1444	2136	rundll32.exe	28
PID 2136 wrote to memory of 1444	2136	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b33347e85229a9be28205436548e3de45c1f25a5b6a32b77be4af94af5e9534.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b33347e85229a9be28205436548e3de45c1f25a5b6a32b77be4af94af5e9534.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1444