f83d3604eaee019fd517e714382c1aaa6dfda486ff9c39fa908fb1e0b9104fd3

Analysis

max time kernel
91s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2022 15:22

Target

f83d3604eaee019fd517e714382c1aaa6dfda486ff9c39fa908fb1e0b9104fd3.dll
Size

311KB
MD5

1b593f716a486862cbc8a366426fd920
SHA1

09fa3089eb14a991e62946fead248414d321e371
SHA256

f83d3604eaee019fd517e714382c1aaa6dfda486ff9c39fa908fb1e0b9104fd3
SHA512

788bb2bd52669ec2521fa3dd78c210d7e2e0f641f0f7528fc488ac8700b3a2b5917d98a01c94584c3ffd19d06672c9294f326c48fbce24a9b72db71c16702e42
SSDEEP

6144:d9P1dpyl/RFOlC19Sp6P4v8eNrs/BpoIP3:daJFuA9zD/B26

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
840	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 840	2692	rundll32.exe	81
PID 2692 wrote to memory of 840	2692	rundll32.exe	81
PID 2692 wrote to memory of 840	2692	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f83d3604eaee019fd517e714382c1aaa6dfda486ff9c39fa908fb1e0b9104fd3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f83d3604eaee019fd517e714382c1aaa6dfda486ff9c39fa908fb1e0b9104fd3.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:840

memory/840-133-0x0000000075720000-0x0000000075776000-memory.dmp

Filesize
344KB

Download