d7d724785aef33e7c20a4a7324fe65edb27e4d8d9f0836671dcd11b981d806d7

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
13/01/2024, 23:30

Target

d7d724785aef33e7c20a4a7324fe65edb27e4d8d9f0836671dcd11b981d806d7.dll
Size

51KB
MD5

b924a5930afd83826f7d041446d924cb
SHA1

35af581e4ac2a38ad1187ab2ceb2700a0ef7d292
SHA256

d7d724785aef33e7c20a4a7324fe65edb27e4d8d9f0836671dcd11b981d806d7
SHA512

03c3013df8edc2210c8acaed1d6fe3bdf5c559f99d18607d9898b79513589792435fd07fd17f871ec014777dda839835dd4b4f935d6a19dc33597625b1e33076
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL2JYH5:1dWubF3n9S91BF3fboKJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4384	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3320 wrote to memory of 4384	3320	rundll32.exe	89
PID 3320 wrote to memory of 4384	3320	rundll32.exe	89
PID 3320 wrote to memory of 4384	3320	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d7d724785aef33e7c20a4a7324fe65edb27e4d8d9f0836671dcd11b981d806d7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3320
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d7d724785aef33e7c20a4a7324fe65edb27e4d8d9f0836671dcd11b981d806d7.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4384