9deb6366671a96b388e59eee9a824aef4be7ecb33b1d7430f1c5a7497d5299af

Analysis

max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 17:12

Target

9deb6366671a96b388e59eee9a824aef4be7ecb33b1d7430f1c5a7497d5299af.dll
Size

265KB
MD5

4817b253fa1834689826d74ce601db8a
SHA1

84cf5a39c1f9cb8201f7f31d865de239e7e11adb
SHA256

9deb6366671a96b388e59eee9a824aef4be7ecb33b1d7430f1c5a7497d5299af
SHA512

ef65f183ba81ffb70794c9d771db063d2a9bd2fcc982934c7a2f06ac79e756552f8996f34a750db5339a7f08dc68da67a3c7e8e5b1532937f6af695608593373
SSDEEP

6144:ENiU5dL835YgJxyY2ZYXTy1G86ELPw2Z5ompbidxHbdZvGQU:i5dL835YgTn2ZYDy1xVPTxidxHTvGQ

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3236	cmd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1456 set thread context of 3236	1456	rundll32.exe	81

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 1456	1244	rundll32.exe	80
PID 1244 wrote to memory of 1456	1244	rundll32.exe	80
PID 1244 wrote to memory of 1456	1244	rundll32.exe	80
PID 1456 wrote to memory of 3236	1456	rundll32.exe	81
PID 1456 wrote to memory of 3236	1456	rundll32.exe	81
PID 1456 wrote to memory of 3236	1456	rundll32.exe	81
PID 1456 wrote to memory of 3236	1456	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9deb6366671a96b388e59eee9a824aef4be7ecb33b1d7430f1c5a7497d5299af.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9deb6366671a96b388e59eee9a824aef4be7ecb33b1d7430f1c5a7497d5299af.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1456
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Deletes itself
    PID:3236

memory/1456-134-0x0000000000E23000-0x0000000000E58000-memory.dmp

Filesize
212KB

Download