0c659fd32ecb6e64f8cc0c15f42f0659154b0fdeb093045b7762071ec14a3aa8

Analysis

max time kernel
3s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28/11/2022, 01:23

Target

0c659fd32ecb6e64f8cc0c15f42f0659154b0fdeb093045b7762071ec14a3aa8.dll
Size

311KB
MD5

0b80bf406a28266348bdbaf952563484
SHA1

82629ccb3a1f39c22ee6e3819ebaba525523abeb
SHA256

0c659fd32ecb6e64f8cc0c15f42f0659154b0fdeb093045b7762071ec14a3aa8
SHA512

cdbf248813796e9cdf0e21563b24c3668ba353bf024ff5b4542b82ac14d657fa740d4e0c109e24b215012ea6b325c0df37f1d94feb9ee7c8f82df14d64266c7c
SSDEEP

6144:P9P1dpyl/RFOlC19Sp6P4v8eNrs/BpoIP3:PaJFuA9zD/B26

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1128	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 1128	1312	rundll32.exe	28
PID 1312 wrote to memory of 1128	1312	rundll32.exe	28
PID 1312 wrote to memory of 1128	1312	rundll32.exe	28
PID 1312 wrote to memory of 1128	1312	rundll32.exe	28
PID 1312 wrote to memory of 1128	1312	rundll32.exe	28
PID 1312 wrote to memory of 1128	1312	rundll32.exe	28
PID 1312 wrote to memory of 1128	1312	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c659fd32ecb6e64f8cc0c15f42f0659154b0fdeb093045b7762071ec14a3aa8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c659fd32ecb6e64f8cc0c15f42f0659154b0fdeb093045b7762071ec14a3aa8.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1128

memory/1128-55-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download
memory/1128-56-0x00000000750D0000-0x0000000075126000-memory.dmp

Filesize
344KB

Download