Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18/03/2024, 15:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d3db77d092c0ed097bd54083451485b8.dll
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
d3db77d092c0ed097bd54083451485b8.dll
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
d3db77d092c0ed097bd54083451485b8.dll
-
Size
251KB
-
MD5
d3db77d092c0ed097bd54083451485b8
-
SHA1
0145fc1466e744be6c13385ccd1c8042d312e7b2
-
SHA256
72808376efb78dee452ba3f4e98b7c6110ee66ea06bf5bd35571ce1733467ee1
-
SHA512
e93d26214e5ef0ecb41bc3497ab2021067d6f9e3e69bff6370d2631baef7d7162184e0036343695380331842ccf87701c170fdc826b2fe98f8ee70a8d13e6db2
-
SSDEEP
3072:572tAy/YnrtNmPVWvb4dMYrJSQ2dbbsbYT00wRIz0oXugiRE1RJVdfET84bmyopP:FdpItLCk8TNn4giRgR7da8EmyKAp
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2212 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1364 wrote to memory of 2212 1364 rundll32.exe 28 PID 1364 wrote to memory of 2212 1364 rundll32.exe 28 PID 1364 wrote to memory of 2212 1364 rundll32.exe 28 PID 1364 wrote to memory of 2212 1364 rundll32.exe 28 PID 1364 wrote to memory of 2212 1364 rundll32.exe 28 PID 1364 wrote to memory of 2212 1364 rundll32.exe 28 PID 1364 wrote to memory of 2212 1364 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d3db77d092c0ed097bd54083451485b8.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d3db77d092c0ed097bd54083451485b8.dll,#12⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2212
-