5baee55663a6ccc67551c2cb01758488ed9b0d26d1e7b57e1e9cdb46f10428e5

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 20:39

Target

5baee55663a6ccc67551c2cb01758488ed9b0d26d1e7b57e1e9cdb46f10428e5.dll
Size

51KB
MD5

63f437ea611bebccee5c72e8c2795c8d
SHA1

46d9ae6b456fa4d9a37d933a18964e38375a4ce6
SHA256

5baee55663a6ccc67551c2cb01758488ed9b0d26d1e7b57e1e9cdb46f10428e5
SHA512

6c0780cae665675c6176600c21734d0355cf92f5f536cad84c56f0aa8311d1a4a216288cbdacca5c2409b845b809c26f55938e4e1d392493e21a1a80ba6e0baa
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLCJYH5:1dWubF3n9S91BF3fboeJYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1788	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 1788	2484	rundll32.exe	28
PID 2484 wrote to memory of 1788	2484	rundll32.exe	28
PID 2484 wrote to memory of 1788	2484	rundll32.exe	28
PID 2484 wrote to memory of 1788	2484	rundll32.exe	28
PID 2484 wrote to memory of 1788	2484	rundll32.exe	28
PID 2484 wrote to memory of 1788	2484	rundll32.exe	28
PID 2484 wrote to memory of 1788	2484	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5baee55663a6ccc67551c2cb01758488ed9b0d26d1e7b57e1e9cdb46f10428e5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5baee55663a6ccc67551c2cb01758488ed9b0d26d1e7b57e1e9cdb46f10428e5.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1788