8f5967d5c38bda4b725e62baaa0adb527478ac6f830fb5d9ba725b60951f1cd7

Analysis

max time kernel
119s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-04-2024 19:04

Target

8f5967d5c38bda4b725e62baaa0adb527478ac6f830fb5d9ba725b60951f1cd7.dll
Size

146KB
MD5

5114f5d2a1197c02e8b9a136f29762fc
SHA1

329acc2d3a879c35c94b10fda90108bb22a4ee60
SHA256

8f5967d5c38bda4b725e62baaa0adb527478ac6f830fb5d9ba725b60951f1cd7
SHA512

d6f13fce5507c74c8c5d72b1ed125b626917e3d59701ce5dc1291ceed2efe1e7618d25b0e4d081f00d59944ee173571202c693387cccc84f09d00f3c2fbfc9b7
SSDEEP

3072:4MNA1x0OyQC8offLFDl+HQijSs3qUImMaOr6IYRl3F0uAL2DwN:FKMIoHLdkwyc5aX0R2D

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2608	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 2608	2588	rundll32.exe	28
PID 2588 wrote to memory of 2608	2588	rundll32.exe	28
PID 2588 wrote to memory of 2608	2588	rundll32.exe	28
PID 2588 wrote to memory of 2608	2588	rundll32.exe	28
PID 2588 wrote to memory of 2608	2588	rundll32.exe	28
PID 2588 wrote to memory of 2608	2588	rundll32.exe	28
PID 2588 wrote to memory of 2608	2588	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8f5967d5c38bda4b725e62baaa0adb527478ac6f830fb5d9ba725b60951f1cd7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8f5967d5c38bda4b725e62baaa0adb527478ac6f830fb5d9ba725b60951f1cd7.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2608

memory/2608-0-0x00000000745C0000-0x0000000074604000-memory.dmp

Filesize
272KB

Download
memory/2608-1-0x0000000074560000-0x00000000745A4000-memory.dmp

Filesize
272KB

Download
memory/2608-3-0x0000000074570000-0x00000000745B4000-memory.dmp

Filesize
272KB

Download
memory/2608-5-0x00000000745C0000-0x0000000074604000-memory.dmp

Filesize
272KB

Download