d33f81e3449f36a16e76c4322bbaa530f2db05ec32b34b8dc8d047788416629e

Analysis

max time kernel
147s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2024, 20:37

Target

d33f81e3449f36a16e76c4322bbaa530f2db05ec32b34b8dc8d047788416629e.dll
Size

51KB
MD5

cb4494ea7bd9a9003f090f255e79ca8e
SHA1

5acdb13daf6e177bcfc7bad025c1958f3dd73dcc
SHA256

d33f81e3449f36a16e76c4322bbaa530f2db05ec32b34b8dc8d047788416629e
SHA512

77b6da25e9fd31196bcb8861866b12f9de2ea5fd25aecfd2b23b31433645b54cbcb9bba480ca6d6049c58a5f04c2cc311e74661f878c17e41e4f50aad006177b
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL/JYH5:1dWubF3n9S91BF3fbobJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
64	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 700 wrote to memory of 64	700	rundll32.exe	87
PID 700 wrote to memory of 64	700	rundll32.exe	87
PID 700 wrote to memory of 64	700	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d33f81e3449f36a16e76c4322bbaa530f2db05ec32b34b8dc8d047788416629e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d33f81e3449f36a16e76c4322bbaa530f2db05ec32b34b8dc8d047788416629e.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:64