73ed0529811287a4fae1a11c4cb254424a9913d1219d068c535a9c08e66a7e76

Analysis

max time kernel
9s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 23:21

Target

73ed0529811287a4fae1a11c4cb254424a9913d1219d068c535a9c08e66a7e76.dll
Size

170KB
MD5

4bd7f9e57f4ffd66b1ff8f76e13c8f70
SHA1

a8dd8a17968681b8ed38351ad413274c00d0cc27
SHA256

73ed0529811287a4fae1a11c4cb254424a9913d1219d068c535a9c08e66a7e76
SHA512

e030b035af5e446554c9f5fa18f9c88bc92a2373d725de60b27878b5aa74bb3fb5ff3bd596031111a338a35308beb7b6008170a8b94d756378208b720729c976
SSDEEP

3072:8TtvejdXwDj5cciTeLOjRrJyRQFmHftiqibIojqlfI1+EWvqj:q2XPbGO1JSIwftiqisoelfVa

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

rundll32.exe

pid process

912 rundll32.exe

pid	process
912	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1124 wrote to memory of 912	1124	rundll32.exe	rundll32.exe
PID 1124 wrote to memory of 912	1124	rundll32.exe	rundll32.exe
PID 1124 wrote to memory of 912	1124	rundll32.exe	rundll32.exe
PID 1124 wrote to memory of 912	1124	rundll32.exe	rundll32.exe
PID 1124 wrote to memory of 912	1124	rundll32.exe	rundll32.exe
PID 1124 wrote to memory of 912	1124	rundll32.exe	rundll32.exe
PID 1124 wrote to memory of 912	1124	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\73ed0529811287a4fae1a11c4cb254424a9913d1219d068c535a9c08e66a7e76.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1124

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\73ed0529811287a4fae1a11c4cb254424a9913d1219d068c535a9c08e66a7e76.dll,#1
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:912

memory/912-54-0x0000000000000000-mapping.dmp

Download
memory/912-55-0x0000000076401000-0x0000000076403000-memory.dmp

Filesize
8KB

Download