7da39b179afa23c14c5011e64f56bcefe7616ebc347b5b5f635e2e5699342490

Analysis

max time kernel
169s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 21:57

Target

7da39b179afa23c14c5011e64f56bcefe7616ebc347b5b5f635e2e5699342490.dll
Size

163KB
MD5

5a3e2e4bb31829ddc404ba23335a2774
SHA1

199d10631a281c63c9eb4c4b59462a972cf57ee0
SHA256

7da39b179afa23c14c5011e64f56bcefe7616ebc347b5b5f635e2e5699342490
SHA512

be3025b1330469d7fd49fd1ab1915152e791670dec3dcc8e9e9004fec5db6fb6de5b49a6b72d0c2979b251cb72a9e1194dfd3db4154d3838807d1c645f12565d
SSDEEP

3072:au2ic/Sn2S3qaE8ZU1afDqRrdiz74fezjd0Hzp2DiUkldAg2U6W4:a/iuSPJZwdu7Aez5ofA

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2232	cmd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3104 set thread context of 2232	3104	rundll32.exe	84

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 3104	4520	rundll32.exe	81
PID 4520 wrote to memory of 3104	4520	rundll32.exe	81
PID 4520 wrote to memory of 3104	4520	rundll32.exe	81
PID 3104 wrote to memory of 2232	3104	rundll32.exe	84
PID 3104 wrote to memory of 2232	3104	rundll32.exe	84
PID 3104 wrote to memory of 2232	3104	rundll32.exe	84
PID 3104 wrote to memory of 2232	3104	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7da39b179afa23c14c5011e64f56bcefe7616ebc347b5b5f635e2e5699342490.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7da39b179afa23c14c5011e64f56bcefe7616ebc347b5b5f635e2e5699342490.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3104
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Deletes itself
    PID:2232

memory/3104-133-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3104-134-0x000000000103E000-0x0000000001057000-memory.dmp

Filesize
100KB

Download
memory/3104-136-0x000000000103E000-0x0000000001057000-memory.dmp

Filesize
100KB

Download