43257c51839d7b3bc25f98a99941d2a2e9a7bdcb34c4af6bd20f0d1110988477

Analysis

max time kernel
144s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:28

Target

43257c51839d7b3bc25f98a99941d2a2e9a7bdcb34c4af6bd20f0d1110988477.dll
Size

183KB
MD5

adb4c1c6d319504ab18541730c0b0449
SHA1

8acc1330d2c5720b7c4c1ed81029872d196f058f
SHA256

43257c51839d7b3bc25f98a99941d2a2e9a7bdcb34c4af6bd20f0d1110988477
SHA512

83256d6e84e9c99b901460eb2fd6d2e518b0baceab24edb1ec560ab3f503e16b3c6c357eed31b0f505be733879175cad2c4042fab093def0e31951b5c2bfce68
SSDEEP

3072:cBzyhfCTczV+dlFWwtP9VT5YKsLqdJ2Yai9UQ0Hs6+fA+XJd5wxSoGB2QUNAXm:cBzaqTcgdlMwtPN/nL2Yb/0mA8lw5G22

Score

7^/10

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1680 cmd.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 5096 set thread context of 1680 5096 rundll32.exe cmd.exe

pid	process
1680	cmd.exe

description	pid	process	target process
PID 5096 set thread context of 1680	5096	rundll32.exe	cmd.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1032 wrote to memory of 5096	1032	rundll32.exe	rundll32.exe
PID 1032 wrote to memory of 5096	1032	rundll32.exe	rundll32.exe
PID 1032 wrote to memory of 5096	1032	rundll32.exe	rundll32.exe
PID 5096 wrote to memory of 1680	5096	rundll32.exe	cmd.exe
PID 5096 wrote to memory of 1680	5096	rundll32.exe	cmd.exe
PID 5096 wrote to memory of 1680	5096	rundll32.exe	cmd.exe
PID 5096 wrote to memory of 1680	5096	rundll32.exe	cmd.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\43257c51839d7b3bc25f98a99941d2a2e9a7bdcb34c4af6bd20f0d1110988477.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\43257c51839d7b3bc25f98a99941d2a2e9a7bdcb34c4af6bd20f0d1110988477.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Deletes itself
    PID:1680

memory/1680-138-0x0000000000000000-mapping.dmp

Download
memory/5096-132-0x0000000000000000-mapping.dmp

Download
memory/5096-133-0x0000000000D10000-0x0000000000D47000-memory.dmp

Filesize
220KB

Download
memory/5096-135-0x0000000000D10000-0x0000000000D47000-memory.dmp

Filesize
220KB

Download
memory/5096-134-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/5096-136-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/5096-137-0x0000000000D10000-0x0000000000D47000-memory.dmp

Filesize
220KB

Download
memory/5096-139-0x0000000000D10000-0x0000000000D47000-memory.dmp

Filesize
220KB

Download