1f7d68f28bbc4d563d35a603af30fde3988a0f02bbf603e3f0c468ba94f3cf4e

Analysis

max time kernel
151s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 16:58

Target

1f7d68f28bbc4d563d35a603af30fde3988a0f02bbf603e3f0c468ba94f3cf4e.dll
Size

311KB
MD5

0942f9493b1b5b2f4e5639b7e5ff5ec0
SHA1

8b82e33fe02236c2dfb50bc2f053ee76fae81a10
SHA256

1f7d68f28bbc4d563d35a603af30fde3988a0f02bbf603e3f0c468ba94f3cf4e
SHA512

5074acd2e37c4afb63565cf5101797ae7b1278f9f3ba254a9aa4f37ed5b88ba6583ffbd32ec12996c8601108e84830f7b218ec1bd1b8ed9ca15be56751bcb988
SSDEEP

6144:s9P1dpyl/RFOlC19Sp6P4v8eNrs/BpoIP3:saJFuA9zD/B26

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1128	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3224 wrote to memory of 1128	3224	rundll32.exe	82
PID 3224 wrote to memory of 1128	3224	rundll32.exe	82
PID 3224 wrote to memory of 1128	3224	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1f7d68f28bbc4d563d35a603af30fde3988a0f02bbf603e3f0c468ba94f3cf4e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1f7d68f28bbc4d563d35a603af30fde3988a0f02bbf603e3f0c468ba94f3cf4e.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1128

memory/1128-133-0x00000000748E0000-0x0000000074936000-memory.dmp

Filesize
344KB

Download