a2c0fd9fcac76d27f6d247f6089582ae934bc8c49bd04af464e0d1ce2f29c6a0

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 10:18

Target

a2c0fd9fcac76d27f6d247f6089582ae934bc8c49bd04af464e0d1ce2f29c6a0.dll
Size

1.4MB
MD5

a48d43a4941e4d9217be80412dae65a3
SHA1

9851692fe0a780e0274101b0b91e3a47831b2e49
SHA256

a2c0fd9fcac76d27f6d247f6089582ae934bc8c49bd04af464e0d1ce2f29c6a0
SHA512

4661191a87083ebcce233b69f152ad32d902f4ccb602a9de10a9e07a68bc3b32cf76effce0f4460dfc2a4923589a3fb7af05b5122a5f0443217ca039df839c4c
SSDEEP

24576:yllj5JC7qVOuFN4IE7HUfMbmz5bcV2cZpoSFFGPw9TCBH932depnY3rIcja2NU5m:4TJC7KpEUMqz9cV2s5rGUTi9ebDakedI

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1628	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3016	1628	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 1628	2096	rundll32.exe	28
PID 2096 wrote to memory of 1628	2096	rundll32.exe	28
PID 2096 wrote to memory of 1628	2096	rundll32.exe	28
PID 2096 wrote to memory of 1628	2096	rundll32.exe	28
PID 2096 wrote to memory of 1628	2096	rundll32.exe	28
PID 2096 wrote to memory of 1628	2096	rundll32.exe	28
PID 2096 wrote to memory of 1628	2096	rundll32.exe	28
PID 1628 wrote to memory of 3016	1628	rundll32.exe	29
PID 1628 wrote to memory of 3016	1628	rundll32.exe	29
PID 1628 wrote to memory of 3016	1628	rundll32.exe	29
PID 1628 wrote to memory of 3016	1628	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a2c0fd9fcac76d27f6d247f6089582ae934bc8c49bd04af464e0d1ce2f29c6a0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a2c0fd9fcac76d27f6d247f6089582ae934bc8c49bd04af464e0d1ce2f29c6a0.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 256
    3⤵
    - Program crash
    PID:3016

memory/1628-0-0x0000000001F30000-0x0000000002147000-memory.dmp

Filesize
2.1MB

Download
memory/1628-1-0x0000000001F30000-0x0000000002147000-memory.dmp

Filesize
2.1MB

Download
memory/1628-2-0x0000000001F30000-0x0000000002147000-memory.dmp

Filesize
2.1MB

Download
memory/1628-4-0x0000000001F30000-0x0000000002147000-memory.dmp

Filesize
2.1MB

Download
memory/1628-5-0x0000000001F31000-0x0000000001F3C000-memory.dmp

Filesize
44KB

Download