9e237a7f6ac1cf308fbfd8fc49112e7024948679be6ac96d80c3502c07178fb0

Analysis

max time kernel
243s
max time network
258s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 13:18

Target

9e237a7f6ac1cf308fbfd8fc49112e7024948679be6ac96d80c3502c07178fb0.dll
Size

203KB
MD5

f4cb7254e844cffc213688e753807dcd
SHA1

c8663b8f8d73015efd52d1df1c210a1efc84c306
SHA256

9e237a7f6ac1cf308fbfd8fc49112e7024948679be6ac96d80c3502c07178fb0
SHA512

82d305f1a61c9b8d91b9e3b4afb0bce197677d04cdd2de8c952e85a5517277d947db0349b63f1a310903378b87eaf03e23dfd5730e7325c3be579f8503481320
SSDEEP

3072:9xr5yQyt+wj8deSv8um9iDTMFC3EJXaSMeh2oCC78I8hnH94uU5mnkT0fEfYh:9mtLc8ukC6Meh9Ck8IaZfkTPQ

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2352	cmd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3200 set thread context of 2352	3200	rundll32.exe	83

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 3200	2548	rundll32.exe	81
PID 2548 wrote to memory of 3200	2548	rundll32.exe	81
PID 2548 wrote to memory of 3200	2548	rundll32.exe	81
PID 3200 wrote to memory of 2352	3200	rundll32.exe	83
PID 3200 wrote to memory of 2352	3200	rundll32.exe	83
PID 3200 wrote to memory of 2352	3200	rundll32.exe	83
PID 3200 wrote to memory of 2352	3200	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9e237a7f6ac1cf308fbfd8fc49112e7024948679be6ac96d80c3502c07178fb0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9e237a7f6ac1cf308fbfd8fc49112e7024948679be6ac96d80c3502c07178fb0.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3200
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Deletes itself
    PID:2352

memory/3200-133-0x00000000007F0000-0x000000000082B000-memory.dmp

Filesize
236KB

Download
memory/3200-134-0x00000000007F1000-0x000000000081C000-memory.dmp

Filesize
172KB

Download
memory/3200-135-0x00000000007F0000-0x000000000082B000-memory.dmp

Filesize
236KB

Download
memory/3200-136-0x0000000000830000-0x000000000086B000-memory.dmp

Filesize
236KB

Download
memory/3200-137-0x00000000007F0000-0x000000000082B000-memory.dmp

Filesize
236KB

Download
memory/3200-138-0x0000000000830000-0x000000000086B000-memory.dmp

Filesize
236KB

Download
memory/3200-140-0x0000000000830000-0x000000000086B000-memory.dmp

Filesize
236KB

Download