8aac99035f9d59d4b903ea0792fd102ef39d613a670a5346c3aa747c1e0b9a5e

Resubmissions

03/09/2023, 00:09

02/09/2023, 23:31

max time kernel
140s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
03/09/2023, 00:09

Target

Primordial.dll
Size

17.1MB
MD5

813f69f601f2177a14e9282e14bcffa1
SHA1

66c3b6ee63eb0852ac2dfd2e9afc1e3dc56767f8
SHA256

8aac99035f9d59d4b903ea0792fd102ef39d613a670a5346c3aa747c1e0b9a5e
SHA512

bab6d141a151af3fa4b6e278ea43d8efced6a99f8a9279f81fb5f9deca6c35e1865b390dbcf1d34d7925f3c170965b41a129be6978107d13b052b31d914065df
SSDEEP

3072:1lbMw6KQE0K19jxph0LR/hSMXlk4ZqKFya5XB67Tzn+Yl:145Enph0lhSMXlBXBWH+Yl

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3412	rundll32.exe
3412	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3276	3412	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3380 wrote to memory of 3412	3380	rundll32.exe	84
PID 3380 wrote to memory of 3412	3380	rundll32.exe	84
PID 3380 wrote to memory of 3412	3380	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Primordial.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Primordial.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:3412
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 580
    3⤵
    - Program crash
    PID:3276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3412 -ip 3412
1⤵
PID:5028