14b4deb1ca7fbef93f431a1ab9fd4ce58b1d20c03342e359f3ff3734e116afd7

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02/09/2022, 10:17

Target
14b4deb1ca7fbef93f431a1ab9fd4ce58b1d20c03342e359f3ff3734e116afd7.dll
Size 2.7MB
Sample220902-mbc4saccbq
SHA256 14b4deb1ca7fbef93f431a1ab9fd4ce58b1d20c03342e359f3ff3734e116afd7
MD5 69c76434973e66a083b2fc19c8b9107a
SHA1 9b2769e2febf5f6867e5fb4eaa682271d5d04c99
SHA512 fbfc44d9b08a6d0e5aea6c65b850d442e6a6a435c64153e9a01932c7071061a272db8428f74e17582f3636acb6eea3a32bcea83eec209abefc9385b7c755ed1b
SSDEEP 49152:NAWpf9CQFUzyJZnuEmamAiZTLVmUPbApIJkw:NApQKzCZurxLVmUPbAAH
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Blocklisted process makes network request 1 IoCs

flow	pid	Process
3	956	rundll32.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
956	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 956	996	rundll32.exe	27
PID 996 wrote to memory of 956	996	rundll32.exe	27
PID 996 wrote to memory of 956	996	rundll32.exe	27
PID 996 wrote to memory of 956	996	rundll32.exe	27
PID 996 wrote to memory of 956	996	rundll32.exe	27
PID 996 wrote to memory of 956	996	rundll32.exe	27
PID 996 wrote to memory of 956	996	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\14b4deb1ca7fbef93f431a1ab9fd4ce58b1d20c03342e359f3ff3734e116afd7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\14b4deb1ca7fbef93f431a1ab9fd4ce58b1d20c03342e359f3ff3734e116afd7.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  PID:956

memory/956-55-0x00000000760E1000-0x00000000760E3000-memory.dmp

Download