53b0e1913a770052f2c5de93f563f85d3d9108e5ff2ff1540eabac7fdafb69da

Analysis

max time kernel
151s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2023 20:01

Target

53b0e1913a770052f2c5de93f563f85d3d9108e5ff2ff1540eabac7fdafb69da.dll
Size

51KB
MD5

e7393f5b6f97be03917a28f020606a4f
SHA1

1c9c6572420cf25a80f269fbb9fbda798cfb3559
SHA256

53b0e1913a770052f2c5de93f563f85d3d9108e5ff2ff1540eabac7fdafb69da
SHA512

e62766ad858e32e5433fd11f351a5d44282fcc37a6a08547bc6ac0d50c0c977181606acba4663f9280c3681bd20de5823c0c8a7467985979a103127e641c3221
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLwJYH5:1dWubF3n9S91BF3fbosJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5036	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 5036	4652	rundll32.exe	88
PID 4652 wrote to memory of 5036	4652	rundll32.exe	88
PID 4652 wrote to memory of 5036	4652	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\53b0e1913a770052f2c5de93f563f85d3d9108e5ff2ff1540eabac7fdafb69da.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\53b0e1913a770052f2c5de93f563f85d3d9108e5ff2ff1540eabac7fdafb69da.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:5036