1b33347e85229a9be28205436548e3de45c1f25a5b6a32b77be4af94af5e9534

Analysis

max time kernel
134s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2023 00:36

Target

1b33347e85229a9be28205436548e3de45c1f25a5b6a32b77be4af94af5e9534.dll
Size

51KB
MD5

45ab20ee6a91f361a6f04768a9957d1d
SHA1

20c01e95698eb24b0b091bcf313775edf88b0c79
SHA256

1b33347e85229a9be28205436548e3de45c1f25a5b6a32b77be4af94af5e9534
SHA512

81235bb36333b88aa7c741f00fabf121b5d953e31823f1b78de6d74675f336d46fa7a5f79bd83d0c97357625e7c53078f4bef6011a17c8c86efe0f6f0ff65fc8
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLoJYH5:1dWubF3n9S91BF3fbosJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4988	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 4988	2856	rundll32.exe	86
PID 2856 wrote to memory of 4988	2856	rundll32.exe	86
PID 2856 wrote to memory of 4988	2856	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b33347e85229a9be28205436548e3de45c1f25a5b6a32b77be4af94af5e9534.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b33347e85229a9be28205436548e3de45c1f25a5b6a32b77be4af94af5e9534.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4988