803eb608ac54661ccf23259c6a8d07fdc26bd83788a661dbd0cf1a08022d4a0f

Analysis

max time kernel
135s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2023 09:37

Target

tekdefense.dll
Size

14KB
MD5

1f3195eff807eceda24c74ea4c483f8c
SHA1

875b5d9b81e27ed8e5dc6fc8610813f68c5f59a9
SHA256

9420c9b7b0e45c2e5440c20cca570e991cbf151babf2537bf3dc08cf6d12c321
SHA512

15125f2c6d89af222fc092b20bf8a560d1913bf45ad54cbb6a94382fa8416054ba1b65261d0ba8e4ff3fbf825a41d7f27a9556dad3ea8e13f1ed7c4587a5c887
SSDEEP

48:6D640H+VzPiZerMpZytjWeyLhnhIAsYBlnfpJo+b23mRhHeq0JEI0oqtIzNi:WmHGzq6tjW33XlfprbSmRhsJNcy

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4940 set thread context of 4348	4940	rundll32.exe	84

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 424 wrote to memory of 4940	424	rundll32.exe	83
PID 424 wrote to memory of 4940	424	rundll32.exe	83
PID 424 wrote to memory of 4940	424	rundll32.exe	83
PID 4940 wrote to memory of 4348	4940	rundll32.exe	84
PID 4940 wrote to memory of 4348	4940	rundll32.exe	84
PID 4940 wrote to memory of 4348	4940	rundll32.exe	84
PID 4940 wrote to memory of 4348	4940	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\tekdefense.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:424
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\tekdefense.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe
    3⤵
    PID:4348