d176d4e682c77e286da69652723320f850992bbf78ad81d150854840d39c0b88

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 07:05

Target

d176d4e682c77e286da69652723320f850992bbf78ad81d150854840d39c0b88.dll
Size

108KB
MD5

197c785997892fb3f93703786a41f4d0
SHA1

683f159d2047e5e3adce22a45af8c2af6737204c
SHA256

d176d4e682c77e286da69652723320f850992bbf78ad81d150854840d39c0b88
SHA512

ffb3986b6f1a74c8a776ce66b60338002e5da415f3f1465594a441e369a00312a0e82b013e157a3d245c2bd774310061e587cb04d7b052904caa119d09039a78
SSDEEP

3072:G0CUUZFSWfdpAecIcBy+w2ppCCDkj6mpUd59sdGFtGp:M9/GAOyC7nkj1+52

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4088	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 4088	1424	rundll32.exe	79
PID 1424 wrote to memory of 4088	1424	rundll32.exe	79
PID 1424 wrote to memory of 4088	1424	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d176d4e682c77e286da69652723320f850992bbf78ad81d150854840d39c0b88.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d176d4e682c77e286da69652723320f850992bbf78ad81d150854840d39c0b88.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:4088

memory/4088-133-0x0000000010000000-0x0000000010038000-memory.dmp

Filesize
224KB

Download