bcd84ff0e24222667a16997057b55c872f66fe4d1e84e60ca5d21c300ca8381c

Analysis

max time kernel
39s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 18:33

Target

bcd84ff0e24222667a16997057b55c872f66fe4d1e84e60ca5d21c300ca8381c.dll
Size

170KB
MD5

50d3088a47affaa543aee95de20b6e80
SHA1

9605fdb3fd2a4f21b18942ebb0f793f7e6970f88
SHA256

bcd84ff0e24222667a16997057b55c872f66fe4d1e84e60ca5d21c300ca8381c
SHA512

5f6026bfbbed4db8eee87faeb0c64d7a29a53070eff6cc36c5864d980b8261bf94a291606c3f43829c6de52c21839478298612885906ca2dd5da68071264cb14
SSDEEP

3072:WTtvejdXwDj5cciTeLOjRrJyRQFmHftiqibIojqlfI1+EWvqj:w2XPbGO1JSIwftiqisoelfVa

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

rundll32.exe

pid process

624 rundll32.exe

pid	process
624	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1728 wrote to memory of 624	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 624	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 624	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 624	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 624	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 624	1728	rundll32.exe	rundll32.exe
PID 1728 wrote to memory of 624	1728	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bcd84ff0e24222667a16997057b55c872f66fe4d1e84e60ca5d21c300ca8381c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1728

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bcd84ff0e24222667a16997057b55c872f66fe4d1e84e60ca5d21c300ca8381c.dll,#1
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:624

memory/624-54-0x0000000000000000-mapping.dmp

Download
memory/624-55-0x0000000076301000-0x0000000076303000-memory.dmp

Filesize
8KB

Download