017ea460db73b2364fbabcb0e6487249c719f4b09d90bf98ab6ef101b2295273

Analysis

max time kernel
92s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28/10/2022, 22:33

Target

017ea460db73b2364fbabcb0e6487249c719f4b09d90bf98ab6ef101b2295273.dll
Size

311KB
MD5

0c63947bd912c2f946785e3087985d4f
SHA1

854e328b4cb6162f3117c329b3e461c8a8f541ff
SHA256

017ea460db73b2364fbabcb0e6487249c719f4b09d90bf98ab6ef101b2295273
SHA512

7b92970539216d486240495373ebfd500b6e499f0d8484307c7aa652550aaf43658531300f8430523baf5251627885aa7a919558d1f4ca7cd38fe737bee97e7b
SSDEEP

6144:39P1dpyl/RFOlC19Sp6P4v8eNrs/BpoIP3:3aJFuA9zD/B26

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1444	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 932 wrote to memory of 1444	932	rundll32.exe	81
PID 932 wrote to memory of 1444	932	rundll32.exe	81
PID 932 wrote to memory of 1444	932	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\017ea460db73b2364fbabcb0e6487249c719f4b09d90bf98ab6ef101b2295273.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\017ea460db73b2364fbabcb0e6487249c719f4b09d90bf98ab6ef101b2295273.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1444

memory/1444-133-0x00000000757A0000-0x00000000757F6000-memory.dmp

Filesize
344KB

Download
memory/1444-134-0x00000000757A0000-0x00000000757F6000-memory.dmp

Filesize
344KB

Download