72808376efb78dee452ba3f4e98b7c6110ee66ea06bf5bd35571ce1733467ee1

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/03/2024, 15:29

Target

d3db77d092c0ed097bd54083451485b8.dll
Size

251KB
MD5

d3db77d092c0ed097bd54083451485b8
SHA1

0145fc1466e744be6c13385ccd1c8042d312e7b2
SHA256

72808376efb78dee452ba3f4e98b7c6110ee66ea06bf5bd35571ce1733467ee1
SHA512

e93d26214e5ef0ecb41bc3497ab2021067d6f9e3e69bff6370d2631baef7d7162184e0036343695380331842ccf87701c170fdc826b2fe98f8ee70a8d13e6db2
SSDEEP

3072:572tAy/YnrtNmPVWvb4dMYrJSQ2dbbsbYT00wRIz0oXugiRE1RJVdfET84bmyopP:FdpItLCk8TNn4giRgR7da8EmyKAp

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2212	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 2212	1364	rundll32.exe	28
PID 1364 wrote to memory of 2212	1364	rundll32.exe	28
PID 1364 wrote to memory of 2212	1364	rundll32.exe	28
PID 1364 wrote to memory of 2212	1364	rundll32.exe	28
PID 1364 wrote to memory of 2212	1364	rundll32.exe	28
PID 1364 wrote to memory of 2212	1364	rundll32.exe	28
PID 1364 wrote to memory of 2212	1364	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3db77d092c0ed097bd54083451485b8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3db77d092c0ed097bd54083451485b8.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2212

memory/2212-0-0x00000000001E0000-0x0000000000222000-memory.dmp

Filesize
264KB

Download
memory/2212-1-0x0000000000270000-0x00000000002B3000-memory.dmp

Filesize
268KB

Download