91303b10e19ba829fcf41e0233de5cc0b13f02eba206e3ce94044f01364449a9

Analysis

max time kernel
112s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 22:58

Target

91303b10e19ba829fcf41e0233de5cc0b13f02eba206e3ce94044f01364449a9.dll
Size

311KB
MD5

20cf42a15ba129193d47ee752b6947b0
SHA1

80bcca4dc5d2292242ea19f4f0ec358f9634314f
SHA256

91303b10e19ba829fcf41e0233de5cc0b13f02eba206e3ce94044f01364449a9
SHA512

005daa32f04bbffd2572d762fdd3aa950fc5f0f10658564889e9d2a5bc5c898337fd1c80ab35204b4bf5e4d598c3c1ec1dc5ec5e7edfc80b463ee32558ed5e13
SSDEEP

6144:c9P1dpyl/RFOlC19Sp6P4v8eNrs/BpoIP3:caJFuA9zD/B26

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5068	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 5068	2340	rundll32.exe	82
PID 2340 wrote to memory of 5068	2340	rundll32.exe	82
PID 2340 wrote to memory of 5068	2340	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\91303b10e19ba829fcf41e0233de5cc0b13f02eba206e3ce94044f01364449a9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\91303b10e19ba829fcf41e0233de5cc0b13f02eba206e3ce94044f01364449a9.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:5068

memory/5068-132-0x0000000000000000-mapping.dmp

Download
memory/5068-133-0x0000000075240000-0x0000000075296000-memory.dmp

Filesize
344KB

Download