72808376efb78dee452ba3f4e98b7c6110ee66ea06bf5bd35571ce1733467ee1

Analysis

max time kernel
150s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18/03/2024, 15:29

Target

d3db77d092c0ed097bd54083451485b8.dll
Size

251KB
MD5

d3db77d092c0ed097bd54083451485b8
SHA1

0145fc1466e744be6c13385ccd1c8042d312e7b2
SHA256

72808376efb78dee452ba3f4e98b7c6110ee66ea06bf5bd35571ce1733467ee1
SHA512

e93d26214e5ef0ecb41bc3497ab2021067d6f9e3e69bff6370d2631baef7d7162184e0036343695380331842ccf87701c170fdc826b2fe98f8ee70a8d13e6db2
SSDEEP

3072:572tAy/YnrtNmPVWvb4dMYrJSQ2dbbsbYT00wRIz0oXugiRE1RJVdfET84bmyopP:FdpItLCk8TNn4giRgR7da8EmyKAp

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1732	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 1732	4656	rundll32.exe	88
PID 4656 wrote to memory of 1732	4656	rundll32.exe	88
PID 4656 wrote to memory of 1732	4656	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3db77d092c0ed097bd54083451485b8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3db77d092c0ed097bd54083451485b8.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1732

memory/1732-0-0x0000000002BC0000-0x0000000002C02000-memory.dmp

Filesize
264KB

Download
memory/1732-1-0x0000000002C90000-0x0000000002CD3000-memory.dmp

Filesize
268KB

Download