bd53b3467a91e3d5072e40af4173af5ea34c9d1526a7a66f9e76ab9382de69a8

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 10:19

Target

bd53b3467a91e3d5072e40af4173af5ea34c9d1526a7a66f9e76ab9382de69a8.dll
Size

51KB
MD5

27aa9a41e62af391ce60bb9680adf9ea
SHA1

737dd62478eece8c6850cd28f60898c04baca882
SHA256

bd53b3467a91e3d5072e40af4173af5ea34c9d1526a7a66f9e76ab9382de69a8
SHA512

fe2adc67ed593e730b75d9791ef500f38fd062d682d89076bce1bdf47db640e37befc40d794ab3c54389bfcd341eec982ed5afeb299c67819f61c5c84b42e4ba
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLcJYH5:1dWubF3n9S91BF3fbo4JYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2700	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2700	2004	rundll32.exe	88
PID 2004 wrote to memory of 2700	2004	rundll32.exe	88
PID 2004 wrote to memory of 2700	2004	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd53b3467a91e3d5072e40af4173af5ea34c9d1526a7a66f9e76ab9382de69a8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd53b3467a91e3d5072e40af4173af5ea34c9d1526a7a66f9e76ab9382de69a8.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2700