6d3b0804d7a6302ae1717d1b915d97990bb419d39e867051727ded8a0cbcaf4a

Analysis

max time kernel
36s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 10:30

Target

6d3b0804d7a6302ae1717d1b915d97990bb419d39e867051727ded8a0cbcaf4a.dll
Size

311KB
MD5

157cc4f1c430d2303299e510ee70e29d
SHA1

c561d85dcd6067388f56b8ef7764c73ed907846d
SHA256

6d3b0804d7a6302ae1717d1b915d97990bb419d39e867051727ded8a0cbcaf4a
SHA512

7392056c0a5aea81fa0dfb0183a3d77db3d3a2a4ff32f61615a7aa4b99c785381de67ba40db42c868b73854217a20e51e683e4477f60dc23dd8e77201e5b9cb7
SSDEEP

6144:W9P1dpyl/RFOlC19Sp6P4v8eNrs/BpoIP3:WaJFuA9zD/B26

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1452	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 1452	904	rundll32.exe	27
PID 904 wrote to memory of 1452	904	rundll32.exe	27
PID 904 wrote to memory of 1452	904	rundll32.exe	27
PID 904 wrote to memory of 1452	904	rundll32.exe	27
PID 904 wrote to memory of 1452	904	rundll32.exe	27
PID 904 wrote to memory of 1452	904	rundll32.exe	27
PID 904 wrote to memory of 1452	904	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d3b0804d7a6302ae1717d1b915d97990bb419d39e867051727ded8a0cbcaf4a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d3b0804d7a6302ae1717d1b915d97990bb419d39e867051727ded8a0cbcaf4a.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1452

memory/1452-54-0x0000000000000000-mapping.dmp

Download
memory/1452-55-0x0000000075E11000-0x0000000075E13000-memory.dmp

Filesize
8KB

Download
memory/1452-56-0x0000000074E90000-0x0000000074EE6000-memory.dmp

Filesize
344KB

Download