d176d4e682c77e286da69652723320f850992bbf78ad81d150854840d39c0b88

Analysis

max time kernel
35s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 07:05

Target

d176d4e682c77e286da69652723320f850992bbf78ad81d150854840d39c0b88.dll
Size

108KB
MD5

197c785997892fb3f93703786a41f4d0
SHA1

683f159d2047e5e3adce22a45af8c2af6737204c
SHA256

d176d4e682c77e286da69652723320f850992bbf78ad81d150854840d39c0b88
SHA512

ffb3986b6f1a74c8a776ce66b60338002e5da415f3f1465594a441e369a00312a0e82b013e157a3d245c2bd774310061e587cb04d7b052904caa119d09039a78
SSDEEP

3072:G0CUUZFSWfdpAecIcBy+w2ppCCDkj6mpUd59sdGFtGp:M9/GAOyC7nkj1+52

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1408	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 1408	1600	rundll32.exe	19
PID 1600 wrote to memory of 1408	1600	rundll32.exe	19
PID 1600 wrote to memory of 1408	1600	rundll32.exe	19
PID 1600 wrote to memory of 1408	1600	rundll32.exe	19
PID 1600 wrote to memory of 1408	1600	rundll32.exe	19
PID 1600 wrote to memory of 1408	1600	rundll32.exe	19
PID 1600 wrote to memory of 1408	1600	rundll32.exe	19

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d176d4e682c77e286da69652723320f850992bbf78ad81d150854840d39c0b88.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d176d4e682c77e286da69652723320f850992bbf78ad81d150854840d39c0b88.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1408

memory/1408-54-0x0000000000000000-mapping.dmp

Download
memory/1408-55-0x0000000075BE1000-0x0000000075BE3000-memory.dmp

Filesize
8KB

Download
memory/1408-56-0x0000000010000000-0x0000000010038000-memory.dmp

Filesize
224KB

Download