6d5562256840a1856dd4e60b20f2d0a0edf8a0c18dbd779ffb501c209385ba9d

Analysis

max time kernel
27s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
07-02-2023 02:08

Target

Common.dll
Size

897KB
MD5

40fd316520f0573077aacb60aff0fbc6
SHA1

4b1e23ba91a049fdc4c97caebc57cac15cb3e9b0
SHA256

0d757ca61be427e699d570364fdd5ec6f5fbeb7654dc67b34bb4b46c69466de5
SHA512

c5cad12ed7b9fc4b6af099a973438e07c0a994084cad893d34eadcc186559560d728a663054c9cfc49864fa52f88d38428088baae853fd887169be46bee8524c
SSDEEP

12288:E6CK1dk6NxNlea9vVBpKZZhYQ6hH6YcSoaZbVAIaJNO:J1d3NlxvVBkOQ6huSoaZbiS

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

rundll32.exe

pid process

1764 rundll32.exe
1764 rundll32.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

1764 rundll32.exe

pid	process
1764	rundll32.exe
1764	rundll32.exe

pid	process
1764	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1980 wrote to memory of 1764	1980	rundll32.exe	rundll32.exe
PID 1980 wrote to memory of 1764	1980	rundll32.exe	rundll32.exe
PID 1980 wrote to memory of 1764	1980	rundll32.exe	rundll32.exe
PID 1980 wrote to memory of 1764	1980	rundll32.exe	rundll32.exe
PID 1980 wrote to memory of 1764	1980	rundll32.exe	rundll32.exe
PID 1980 wrote to memory of 1764	1980	rundll32.exe	rundll32.exe
PID 1980 wrote to memory of 1764	1980	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Common.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1980

memory/1764-54-0x0000000000000000-mapping.dmp

Download
memory/1764-55-0x0000000075891000-0x0000000075893000-memory.dmp

Filesize
8KB

Download
memory/1764-56-0x00000000020A0000-0x00000000066B9000-memory.dmp

Filesize
70.1MB

Download
memory/1764-57-0x0000000000350000-0x00000000003F2000-memory.dmp

Filesize
648KB

Download
memory/1764-58-0x00000000020A0000-0x00000000066B9000-memory.dmp

Filesize
70.1MB

Download
memory/1764-60-0x00000000020A0000-0x00000000066B9000-memory.dmp

Filesize
70.1MB

Download
memory/1764-59-0x00000000020A0000-0x00000000066B9000-memory.dmp

Filesize
70.1MB

Download
memory/1764-63-0x00000000020A0000-0x00000000066B9000-memory.dmp

Filesize
70.1MB

Download