53b02ee9b7df0bb664771ee94f8c01141388a4ff16978d18c37f77089a8c3cad

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
12/02/2024, 21:35

Target

53b02ee9b7df0bb664771ee94f8c01141388a4ff16978d18c37f77089a8c3cad.dll
Size

899KB
MD5

7958c6058451ce67ebfc379dab4dfd71
SHA1

d3a264e6d7dd90249e227b5b3f019a8b38a608b1
SHA256

53b02ee9b7df0bb664771ee94f8c01141388a4ff16978d18c37f77089a8c3cad
SHA512

3424486f7d66443d2dcd15c42eb0239dc2f2dee48275bc296ecd4eb2eb6d9588262271e3655837289d5b37539695361fb0a77ffde690e444547e2111bbc045b7
SSDEEP

24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXM:7wqd87VM

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4664	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 4664	556	rundll32.exe	84
PID 556 wrote to memory of 4664	556	rundll32.exe	84
PID 556 wrote to memory of 4664	556	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\53b02ee9b7df0bb664771ee94f8c01141388a4ff16978d18c37f77089a8c3cad.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\53b02ee9b7df0bb664771ee94f8c01141388a4ff16978d18c37f77089a8c3cad.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:4664