d2ba009a4a0de5484be327f41812c3a0c08dc1755620c1b198b3a3330fb4e5ed

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 01:35

Target

d2ba009a4a0de5484be327f41812c3a0c08dc1755620c1b198b3a3330fb4e5ed.dll
Size

5.4MB
MD5

db5849275ada97b66346819b50a3b6c1
SHA1

b253e285428e99171ba7a465a3b6d6e06c529b31
SHA256

d2ba009a4a0de5484be327f41812c3a0c08dc1755620c1b198b3a3330fb4e5ed
SHA512

08793ebc85397a159e67f15d8e561ddd37c7fdd9de85b3313d476b240bd95a4b5a8992dbf80afd79a8bf3a39e203e28f09998e76ec13c5dcf203f50b4f1a1ab7
SSDEEP

98304:CVxEsouVUnHr0ntn9OIgcX9q4e113oWRVlw8XgurxUVJLjRIfHBizP:4xSuVUHr0ntVq4j4RgG+fIP

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1696	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1696	rundll32.exe
1696	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1696	1652	rundll32.exe	28
PID 1652 wrote to memory of 1696	1652	rundll32.exe	28
PID 1652 wrote to memory of 1696	1652	rundll32.exe	28
PID 1652 wrote to memory of 1696	1652	rundll32.exe	28
PID 1652 wrote to memory of 1696	1652	rundll32.exe	28
PID 1652 wrote to memory of 1696	1652	rundll32.exe	28
PID 1652 wrote to memory of 1696	1652	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d2ba009a4a0de5484be327f41812c3a0c08dc1755620c1b198b3a3330fb4e5ed.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d2ba009a4a0de5484be327f41812c3a0c08dc1755620c1b198b3a3330fb4e5ed.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:1696

memory/1696-4-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/1696-2-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/1696-0-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/1696-5-0x0000000072DE0000-0x0000000073730000-memory.dmp

Filesize
9.3MB

Download
memory/1696-9-0x0000000072E0D000-0x000000007311D000-memory.dmp

Filesize
3.1MB

Download
memory/1696-10-0x0000000072DE0000-0x0000000073730000-memory.dmp

Filesize
9.3MB

Download