9966f2697b471de85420996774dc333a0c214802f47aaa397f963a30ffb05183

Analysis

max time kernel
203s
max time network
207s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 11:33

Target

9966f2697b471de85420996774dc333a0c214802f47aaa397f963a30ffb05183.dll
Size

278KB
MD5

db19159e8e6b20ba6dfa9a2b7717fbd0
SHA1

a51f9d806b67333e1d29e6e46a620d1564d1bbe5
SHA256

9966f2697b471de85420996774dc333a0c214802f47aaa397f963a30ffb05183
SHA512

6d7d0076df9b12602799de7cf06470770faabe0323e66cd4cd7174e8df9a8525f4fb17e7c30435791ea721ccb67eecc0964f9bcd98461fc91826ca947a57372a
SSDEEP

3072:CDbbSetVGA86B91/W+bjcY3h3xrV0mxasoOHh6r:CDNXG/M91u+Tx3xrdasJB

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4776	cmd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2324 set thread context of 4776	2324	rundll32.exe	83

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 2324	3980	rundll32.exe	82
PID 3980 wrote to memory of 2324	3980	rundll32.exe	82
PID 3980 wrote to memory of 2324	3980	rundll32.exe	82
PID 2324 wrote to memory of 4776	2324	rundll32.exe	83
PID 2324 wrote to memory of 4776	2324	rundll32.exe	83
PID 2324 wrote to memory of 4776	2324	rundll32.exe	83
PID 2324 wrote to memory of 4776	2324	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9966f2697b471de85420996774dc333a0c214802f47aaa397f963a30ffb05183.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9966f2697b471de85420996774dc333a0c214802f47aaa397f963a30ffb05183.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Deletes itself
    PID:4776

memory/2324-133-0x0000000002140000-0x000000000218B000-memory.dmp

Filesize
300KB

Download
memory/2324-135-0x00000000021B0000-0x00000000021D0000-memory.dmp

Filesize
128KB

Download
memory/2324-136-0x0000000002140000-0x000000000215F000-memory.dmp

Filesize
124KB

Download