e135656d6b7ef7505f5570f934dd8bf8426e6590a0fdaf9d7d96b9ab5443601e

Analysis

max time kernel
141s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 03:03

Target

259db3ac2bf82eaa0d7767dd35860cb8.dll
Size

569KB
MD5

259db3ac2bf82eaa0d7767dd35860cb8
SHA1

3755d96843b76d90590abd58a5a0a5784c7d8eae
SHA256

e135656d6b7ef7505f5570f934dd8bf8426e6590a0fdaf9d7d96b9ab5443601e
SHA512

9296c4769f587327731759e02a7363297356242939d3495cf097c9430d371459da96d51cb735217cb60188f33f4541cc23f861a713494d5118abc4e5231fc53c
SSDEEP

12288:ze5EaX2NnIe2g/lD7hI/aWS6ec/rZ01++TQvupjBd8TkJiwaPiW:C+aXwnIe2Yi/aWS6eKiTQ4BmTsaq

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
296	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2664	296	WerFault.exe	14

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 312 wrote to memory of 296	312	rundll32.exe	14
PID 312 wrote to memory of 296	312	rundll32.exe	14
PID 312 wrote to memory of 296	312	rundll32.exe	14
PID 312 wrote to memory of 296	312	rundll32.exe	14
PID 312 wrote to memory of 296	312	rundll32.exe	14
PID 312 wrote to memory of 296	312	rundll32.exe	14
PID 312 wrote to memory of 296	312	rundll32.exe	14
PID 296 wrote to memory of 2664	296	rundll32.exe	26
PID 296 wrote to memory of 2664	296	rundll32.exe	26
PID 296 wrote to memory of 2664	296	rundll32.exe	26
PID 296 wrote to memory of 2664	296	rundll32.exe	26

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\259db3ac2bf82eaa0d7767dd35860cb8.dll,#1
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:296
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 296 -s 252
  2⤵
  - Program crash
  PID:2664

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\259db3ac2bf82eaa0d7767dd35860cb8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:312

memory/296-0-0x0000000074450000-0x0000000074C1F000-memory.dmp

Filesize
7.8MB

Download
memory/296-3-0x0000000073C90000-0x000000007445F000-memory.dmp

Filesize
7.8MB

Download
memory/296-5-0x0000000074460000-0x0000000074C2F000-memory.dmp

Filesize
7.8MB

Download
memory/296-1-0x0000000074460000-0x0000000074C2F000-memory.dmp

Filesize
7.8MB

Download
memory/296-7-0x0000000074450000-0x0000000074C1F000-memory.dmp

Filesize
7.8MB

Download
memory/296-9-0x0000000074460000-0x0000000074C2F000-memory.dmp

Filesize
7.8MB

Download