e135656d6b7ef7505f5570f934dd8bf8426e6590a0fdaf9d7d96b9ab5443601e

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 14:28

Target

259db3ac2bf82eaa0d7767dd35860cb8.dll
Size

569KB
MD5

259db3ac2bf82eaa0d7767dd35860cb8
SHA1

3755d96843b76d90590abd58a5a0a5784c7d8eae
SHA256

e135656d6b7ef7505f5570f934dd8bf8426e6590a0fdaf9d7d96b9ab5443601e
SHA512

9296c4769f587327731759e02a7363297356242939d3495cf097c9430d371459da96d51cb735217cb60188f33f4541cc23f861a713494d5118abc4e5231fc53c
SSDEEP

12288:ze5EaX2NnIe2g/lD7hI/aWS6ec/rZ01++TQvupjBd8TkJiwaPiW:C+aXwnIe2Yi/aWS6eKiTQ4BmTsaq

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4100	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2008	4100	WerFault.exe	16

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 4100	4944	rundll32.exe	16
PID 4944 wrote to memory of 4100	4944	rundll32.exe	16
PID 4944 wrote to memory of 4100	4944	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\259db3ac2bf82eaa0d7767dd35860cb8.dll,#1
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4100 -s 600
  2⤵
  - Program crash
  PID:2008

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\259db3ac2bf82eaa0d7767dd35860cb8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4100 -ip 4100
1⤵
PID:2020

memory/4100-0-0x0000000074250000-0x0000000074A1F000-memory.dmp

Filesize
7.8MB

Download
memory/4100-1-0x0000000074250000-0x0000000074A1F000-memory.dmp

Filesize
7.8MB

Download