7e974b1b794c50555d6387d4399fcb074b865a4acc3162243183ac1ed9fcb863

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 10:26

Target

SecuriteInfo.com.Win32.Evo-gen.10779.4942.dll
Size

10.3MB
MD5

d6d1906f0369c0f9d9412749913567b8
SHA1

74524e4b0c6fea8010ae64c8fd74f03f09049ced
SHA256

7e974b1b794c50555d6387d4399fcb074b865a4acc3162243183ac1ed9fcb863
SHA512

07b259425ca13782ab8f11c2b41dca25573c39d6920781d4b06961e2e15ff49bf80975471fcfb15232d44885eae6a1c5ce76b6f28104d09fc7a862523a97fd8a
SSDEEP

196608:cfiSuXokUdIP5itxx28RhduPhmDbjvbAtMyfo7L5G0i5/Jp2Jhgr:cKPokYoUtvhDbjvbeMkML5ip2Jh

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3880	rundll32.exe
3880	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2704	3880	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3880	rundll32.exe
3880	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 3880	4768	rundll32.exe	81
PID 4768 wrote to memory of 3880	4768	rundll32.exe	81
PID 4768 wrote to memory of 3880	4768	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.10779.4942.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.10779.4942.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:3880
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 672
    3⤵
    - Program crash
    PID:2704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3880 -ip 3880
1⤵
PID:856

memory/3880-1-0x00000000023C4000-0x00000000028F9000-memory.dmp

Filesize
5.2MB

Download
memory/3880-0-0x00000000007A0000-0x00000000007A1000-memory.dmp

Filesize
4KB

Download
memory/3880-2-0x0000000002140000-0x0000000003362000-memory.dmp

Filesize
18.1MB

Download
memory/3880-4-0x0000000002140000-0x0000000003362000-memory.dmp

Filesize
18.1MB

Download
memory/3880-5-0x00000000023C4000-0x00000000028F9000-memory.dmp

Filesize
5.2MB

Download