ee88fd995b6bb3bc633483c567c2a18ce9596cbf8488a765f786d37099707854

Analysis

max time kernel
38s
max time network
4s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 03:38

Target

ee88fd995b6bb3bc633483c567c2a18ce9596cbf8488a765f786d37099707854.dll
Size

160KB
MD5

0d6e134521144118c67a28da1d376ce2
SHA1

cfa4edeeffd33bf336e9446d7b143f6f002b79d1
SHA256

ee88fd995b6bb3bc633483c567c2a18ce9596cbf8488a765f786d37099707854
SHA512

f297f0176bd75c356f5e7cf6e86c750bc753c826951a9e17288629bdd89a909ca29e7a2bc04523b1b02248621f766467db9012f83066fda323e8e049e07921ba
SSDEEP

3072:VIU0JI9xgLIQL90dt3yjaRMSzMtQHuEpsGNYX30Sqfai6/glvnrLEHdMhUSWB:VIUx9OLIQLydtCeRMotH7prc0gOvyMh0

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4188	cmd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1932 set thread context of 4188	1932	rundll32.exe	84

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3724 wrote to memory of 1932	3724	rundll32.exe	17
PID 3724 wrote to memory of 1932	3724	rundll32.exe	17
PID 3724 wrote to memory of 1932	3724	rundll32.exe	17
PID 1932 wrote to memory of 4188	1932	rundll32.exe	84
PID 1932 wrote to memory of 4188	1932	rundll32.exe	84
PID 1932 wrote to memory of 4188	1932	rundll32.exe	84
PID 1932 wrote to memory of 4188	1932	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ee88fd995b6bb3bc633483c567c2a18ce9596cbf8488a765f786d37099707854.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ee88fd995b6bb3bc633483c567c2a18ce9596cbf8488a765f786d37099707854.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Deletes itself
    PID:4188

memory/1932-133-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1932-134-0x00000000014B0000-0x00000000014E3000-memory.dmp

Filesize
204KB

Download
memory/1932-136-0x00000000014B0000-0x00000000014E3000-memory.dmp

Filesize
204KB

Download