1f7d68f28bbc4d563d35a603af30fde3988a0f02bbf603e3f0c468ba94f3cf4e

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21-11-2022 16:58

Target

1f7d68f28bbc4d563d35a603af30fde3988a0f02bbf603e3f0c468ba94f3cf4e.dll
Size

311KB
MD5

0942f9493b1b5b2f4e5639b7e5ff5ec0
SHA1

8b82e33fe02236c2dfb50bc2f053ee76fae81a10
SHA256

1f7d68f28bbc4d563d35a603af30fde3988a0f02bbf603e3f0c468ba94f3cf4e
SHA512

5074acd2e37c4afb63565cf5101797ae7b1278f9f3ba254a9aa4f37ed5b88ba6583ffbd32ec12996c8601108e84830f7b218ec1bd1b8ed9ca15be56751bcb988
SSDEEP

6144:s9P1dpyl/RFOlC19Sp6P4v8eNrs/BpoIP3:saJFuA9zD/B26

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1808	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 1808	1096	rundll32.exe	28
PID 1096 wrote to memory of 1808	1096	rundll32.exe	28
PID 1096 wrote to memory of 1808	1096	rundll32.exe	28
PID 1096 wrote to memory of 1808	1096	rundll32.exe	28
PID 1096 wrote to memory of 1808	1096	rundll32.exe	28
PID 1096 wrote to memory of 1808	1096	rundll32.exe	28
PID 1096 wrote to memory of 1808	1096	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1f7d68f28bbc4d563d35a603af30fde3988a0f02bbf603e3f0c468ba94f3cf4e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1f7d68f28bbc4d563d35a603af30fde3988a0f02bbf603e3f0c468ba94f3cf4e.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1808

memory/1808-55-0x0000000075211000-0x0000000075213000-memory.dmp

Filesize
8KB

Download
memory/1808-56-0x0000000074C00000-0x0000000074C56000-memory.dmp

Filesize
344KB

Download