Analysis
-
max time kernel
139s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/01/2024, 22:47
Behavioral task
behavioral1
Sample
75b46185ee7a3d436817118240cdbaca.dll
Resource
win7-20231129-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
75b46185ee7a3d436817118240cdbaca.dll
Resource
win10v2004-20231215-en
3 signatures
150 seconds
General
-
Target
75b46185ee7a3d436817118240cdbaca.dll
-
Size
485KB
-
MD5
75b46185ee7a3d436817118240cdbaca
-
SHA1
5076aff01f0779e3985e1b1604066b87f0a2b800
-
SHA256
0d00cac16fa96ff2b212e957f3ec86b820dfb25ab24daeb556f4c9747d314b24
-
SHA512
2b318032bcf38aa84c689c3e966239f12cffa70646348aa3bb7ac911f4cef27ad1c80371740125ee72475fffaa3d75ca1a64e194fe820c136bb79ce4c73b6b0b
-
SSDEEP
6144:HFri8VXsqnmxY9CxPHhtD3Xcg9d9qlogheaJM:le8VXsqmSIhBca9CeaJM
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1256-0-0x0000000075480000-0x0000000075502000-memory.dmp upx behavioral2/memory/1256-1-0x0000000075480000-0x0000000075502000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1256 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1156 wrote to memory of 1256 1156 rundll32.exe 87 PID 1156 wrote to memory of 1256 1156 rundll32.exe 87 PID 1156 wrote to memory of 1256 1156 rundll32.exe 87
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\75b46185ee7a3d436817118240cdbaca.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\75b46185ee7a3d436817118240cdbaca.dll,#12⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1256
-