56bfb8d2d89e0764fabbc700f02c76175b1a8e7d464b2f50b4e58e19cc74c883

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 04:20

Target

56bfb8d2d89e0764fabbc700f02c76175b1a8e7d464b2f50b4e58e19cc74c883.dll
Size

51KB
MD5

00c53987b72816f7e36448f524d19986
SHA1

a5dc491a27032c92fe1943b23ad9504b48c91059
SHA256

56bfb8d2d89e0764fabbc700f02c76175b1a8e7d464b2f50b4e58e19cc74c883
SHA512

992bc6075bc007d9a818651afb5451548cd6016efd417fd51a1c1e49f1dc4c72689f2de84981b7608a2b0f0932699ffb1db6d8040e303d84e505868248aaa67a
SSDEEP

1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLYJYH5:1dWubF3n9S91BF3fbo8JYH5

Score

1^/10

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2388	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 2388	1808	rundll32.exe	28
PID 1808 wrote to memory of 2388	1808	rundll32.exe	28
PID 1808 wrote to memory of 2388	1808	rundll32.exe	28
PID 1808 wrote to memory of 2388	1808	rundll32.exe	28
PID 1808 wrote to memory of 2388	1808	rundll32.exe	28
PID 1808 wrote to memory of 2388	1808	rundll32.exe	28
PID 1808 wrote to memory of 2388	1808	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\56bfb8d2d89e0764fabbc700f02c76175b1a8e7d464b2f50b4e58e19cc74c883.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\56bfb8d2d89e0764fabbc700f02c76175b1a8e7d464b2f50b4e58e19cc74c883.dll,#1
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2388