f22ccb692159ba201609feb230c87e0842e8ecd878cf6fecd001ab8740daac72

Analysis

max time kernel
91s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 22:58

Target

f22ccb692159ba201609feb230c87e0842e8ecd878cf6fecd001ab8740daac72.dll
Size

311KB
MD5

93c05bcda23ae73478f5d4d48e890d40
SHA1

995b6906ecb180b2ba1f3d91383893081486c419
SHA256

f22ccb692159ba201609feb230c87e0842e8ecd878cf6fecd001ab8740daac72
SHA512

4df570f739b89bfc2bbc494626cce4b36a740118eb87a233936eb563a02a006197ccf3260c7000e937c4279b6c3502ab55b022cde550a4096ff1b578af16bf5f
SSDEEP

6144:n9P1dpyl/RFOlC19Sp6P4v8eNrs/BpoIP3:naJFuA9zD/B26

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4748	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 4748	4764	rundll32.exe	81
PID 4764 wrote to memory of 4748	4764	rundll32.exe	81
PID 4764 wrote to memory of 4748	4764	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f22ccb692159ba201609feb230c87e0842e8ecd878cf6fecd001ab8740daac72.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f22ccb692159ba201609feb230c87e0842e8ecd878cf6fecd001ab8740daac72.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:4748

memory/4748-133-0x0000000074BE0000-0x0000000074C36000-memory.dmp

Filesize
344KB

Download