a2c0fd9fcac76d27f6d247f6089582ae934bc8c49bd04af464e0d1ce2f29c6a0

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 10:18

Target

a2c0fd9fcac76d27f6d247f6089582ae934bc8c49bd04af464e0d1ce2f29c6a0.dll
Size

1.4MB
MD5

a48d43a4941e4d9217be80412dae65a3
SHA1

9851692fe0a780e0274101b0b91e3a47831b2e49
SHA256

a2c0fd9fcac76d27f6d247f6089582ae934bc8c49bd04af464e0d1ce2f29c6a0
SHA512

4661191a87083ebcce233b69f152ad32d902f4ccb602a9de10a9e07a68bc3b32cf76effce0f4460dfc2a4923589a3fb7af05b5122a5f0443217ca039df839c4c
SSDEEP

24576:yllj5JC7qVOuFN4IE7HUfMbmz5bcV2cZpoSFFGPw9TCBH932depnY3rIcja2NU5m:4TJC7KpEUMqz9cV2s5rGUTi9ebDakedI

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4464	rundll32.exe
4464	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 512 wrote to memory of 4464	512	rundll32.exe	82
PID 512 wrote to memory of 4464	512	rundll32.exe	82
PID 512 wrote to memory of 4464	512	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a2c0fd9fcac76d27f6d247f6089582ae934bc8c49bd04af464e0d1ce2f29c6a0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a2c0fd9fcac76d27f6d247f6089582ae934bc8c49bd04af464e0d1ce2f29c6a0.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:4464

memory/4464-0-0x0000000000400000-0x0000000000617000-memory.dmp

Filesize
2.1MB

Download
memory/4464-1-0x0000000000400000-0x0000000000617000-memory.dmp

Filesize
2.1MB

Download
memory/4464-2-0x0000000000400000-0x0000000000617000-memory.dmp

Filesize
2.1MB

Download
memory/4464-4-0x0000000000400000-0x0000000000617000-memory.dmp

Filesize
2.1MB

Download
memory/4464-5-0x0000000000401000-0x000000000040C000-memory.dmp

Filesize
44KB

Download