91ec3d91605c8898299b3de21eced4c066ec0bd188b4e1a9bda51a41a95f572b

Analysis

max time kernel
139s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2022 15:22

Target

91ec3d91605c8898299b3de21eced4c066ec0bd188b4e1a9bda51a41a95f572b.dll
Size

311KB
MD5

28f8751932f8be126dde403f9ba631b0
SHA1

5f7391d61d08e324f921a067c447a98a104e6121
SHA256

91ec3d91605c8898299b3de21eced4c066ec0bd188b4e1a9bda51a41a95f572b
SHA512

cdfbaa0afe7fa6d3bb29c597598516136c357035030feb1bdf5ac0bd8836152eada026691504d6d6d8f37aece9e0bf9ad2eca7557863097a08c15d186904e33d
SSDEEP

6144:Z9P1dpyl/RFOlC19Sp6P4v8eNrs/BpoIP3:ZaJFuA9zD/B26

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4652	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 4652	4720	rundll32.exe	81
PID 4720 wrote to memory of 4652	4720	rundll32.exe	81
PID 4720 wrote to memory of 4652	4720	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\91ec3d91605c8898299b3de21eced4c066ec0bd188b4e1a9bda51a41a95f572b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\91ec3d91605c8898299b3de21eced4c066ec0bd188b4e1a9bda51a41a95f572b.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:4652

memory/4652-132-0x0000000000000000-mapping.dmp

Download
memory/4652-133-0x0000000074DE0000-0x0000000074E36000-memory.dmp

Filesize
344KB

Download