b3c7f3662815587fea4b2359323f6c454b9475adf5abcf05c9eea274f49fa47d

Analysis

max time kernel
33s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 07:02

Target

b3c7f3662815587fea4b2359323f6c454b9475adf5abcf05c9eea274f49fa47d.dll
Size

516KB
MD5

24ee7e853fd107e5bdf86a9200024fa0
SHA1

365f2a929fd8436be66c8a680948c7d55961baf4
SHA256

b3c7f3662815587fea4b2359323f6c454b9475adf5abcf05c9eea274f49fa47d
SHA512

0fd3eaee1e1c0535c4700995e23a6b76684fa8727926a100105b3e738004bd4c5a8164557b4d5f8d0a6df3538445fb9f1a4e127a7635b882ad1f38754104aea9
SSDEEP

6144:N7SYlGZLp/NXGzPnqh1xGFe57VtQSElAzGDqh29c3dwJ/oaoFQtmBduVYc+2Iz:o/vlXqPngxew7QUz6zUZetmBSm

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1652	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 1652	1588	rundll32.exe	27
PID 1588 wrote to memory of 1652	1588	rundll32.exe	27
PID 1588 wrote to memory of 1652	1588	rundll32.exe	27
PID 1588 wrote to memory of 1652	1588	rundll32.exe	27
PID 1588 wrote to memory of 1652	1588	rundll32.exe	27
PID 1588 wrote to memory of 1652	1588	rundll32.exe	27
PID 1588 wrote to memory of 1652	1588	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b3c7f3662815587fea4b2359323f6c454b9475adf5abcf05c9eea274f49fa47d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b3c7f3662815587fea4b2359323f6c454b9475adf5abcf05c9eea274f49fa47d.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1652

memory/1652-55-0x0000000075661000-0x0000000075663000-memory.dmp

Filesize
8KB

Download