14b4deb1ca7fbef93f431a1ab9fd4ce58b1d20c03342e359f3ff3734e116afd7

Analysis

max time kernel
138s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2022, 10:17

Target
14b4deb1ca7fbef93f431a1ab9fd4ce58b1d20c03342e359f3ff3734e116afd7.dll
Size 2.7MB
Sample220902-mbc4saccbq
SHA256 14b4deb1ca7fbef93f431a1ab9fd4ce58b1d20c03342e359f3ff3734e116afd7
MD5 69c76434973e66a083b2fc19c8b9107a
SHA1 9b2769e2febf5f6867e5fb4eaa682271d5d04c99
SHA512 fbfc44d9b08a6d0e5aea6c65b850d442e6a6a435c64153e9a01932c7071061a272db8428f74e17582f3636acb6eea3a32bcea83eec209abefc9385b7c755ed1b
SSDEEP 49152:NAWpf9CQFUzyJZnuEmamAiZTLVmUPbApIJkw:NApQKzCZurxLVmUPbAAH
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Blocklisted process makes network request 2 IoCs

flow	pid	Process
20	4752	rundll32.exe
26	4752	rundll32.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
4752	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 4752	4204	rundll32.exe	83
PID 4204 wrote to memory of 4752	4204	rundll32.exe	83
PID 4204 wrote to memory of 4752	4204	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\14b4deb1ca7fbef93f431a1ab9fd4ce58b1d20c03342e359f3ff3734e116afd7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\14b4deb1ca7fbef93f431a1ab9fd4ce58b1d20c03342e359f3ff3734e116afd7.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  PID:4752