37738bea145d099c26e209fcdfd6ac0ed805f5c05fbd8ec0e9370ffda0346419

Analysis

Target

BNB3A6Z7APWN48Y8BIV1KLP0U4H5ZF7I2AVUE.dll
Size

9.7MB
MD5

1cef96e373cd8641b51a5a48b35fd9d5
SHA1

ac31b4426799cb5755f76ad13b0d999bc0299cce
SHA256

eb075068d9f815936687ef1fddc320bcdfb68842e13d98faccaef555cb7500ce
SHA512

6e4858ef15806ecb325981571bfe3fc3edaae738623257684439ae627268d8abd8105aae6705fc65a4117d03498ca2708eaade405ce7b9b89a6904eff70d26ed

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1324	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4156	1324	WerFault.exe	78

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 1324	2536	rundll32.exe	78
PID 2536 wrote to memory of 1324	2536	rundll32.exe	78
PID 2536 wrote to memory of 1324	2536	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\BNB3A6Z7APWN48Y8BIV1KLP0U4H5ZF7I2AVUE.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\BNB3A6Z7APWN48Y8BIV1KLP0U4H5ZF7I2AVUE.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:1324
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1324 -s 700
    3⤵
    - Program crash
    PID:4156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1324 -ip 1324
1⤵
PID:4060

memory/1324-131-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download
memory/1324-132-0x0000000000700000-0x0000000000701000-memory.dmp

Filesize
4KB

Download
memory/1324-133-0x00000000009F0000-0x00000000009F1000-memory.dmp

Filesize
4KB

Download
memory/1324-134-0x0000000000C60000-0x0000000000C61000-memory.dmp

Filesize
4KB

Download
memory/1324-135-0x0000000000C70000-0x0000000000C71000-memory.dmp

Filesize
4KB

Download
memory/1324-136-0x0000000000C80000-0x0000000000C81000-memory.dmp

Filesize
4KB

Download
memory/1324-137-0x0000000002290000-0x0000000002291000-memory.dmp

Filesize
4KB

Download
memory/1324-138-0x000000005B6E0000-0x000000005C122000-memory.dmp

Filesize
10.3MB

Download
memory/1324-139-0x000000005B6E0000-0x000000005C122000-memory.dmp

Filesize
10.3MB

Download