e22a65ee0428846fcf535e5ceaf77afe1a7c364eed69492c975b6924022100aa

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 10:59

Target

e22a65ee0428846fcf535e5ceaf77afe1a7c364eed69492c975b6924022100aa.dll
Size

4.3MB
MD5

2ef58336c6105f035fe560b77bc869fd
SHA1

bc9ea4255f31f51c60fe2e446ec5b40dd927a1c1
SHA256

e22a65ee0428846fcf535e5ceaf77afe1a7c364eed69492c975b6924022100aa
SHA512

d52877b209a3db829b5aefde0e8e76ca24c0b282587c4b2956140e5b830e03dbc332b8ea220debb652fdf580dda27f6d8b334cf23d3e1e1ec9aeb122acab383e
SSDEEP

98304:xAWzZQkQ5NC3FyYzMuRAaBggsqM6YkdoDW15sgu4ATU:OeQkQacgMA7Bwqi4oDI2t40U

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1856	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1856	rundll32.exe
1856	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1856	1728	rundll32.exe	28
PID 1728 wrote to memory of 1856	1728	rundll32.exe	28
PID 1728 wrote to memory of 1856	1728	rundll32.exe	28
PID 1728 wrote to memory of 1856	1728	rundll32.exe	28
PID 1728 wrote to memory of 1856	1728	rundll32.exe	28
PID 1728 wrote to memory of 1856	1728	rundll32.exe	28
PID 1728 wrote to memory of 1856	1728	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e22a65ee0428846fcf535e5ceaf77afe1a7c364eed69492c975b6924022100aa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e22a65ee0428846fcf535e5ceaf77afe1a7c364eed69492c975b6924022100aa.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:1856

memory/1856-4-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/1856-2-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/1856-0-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/1856-6-0x0000000074608000-0x000000007484B000-memory.dmp

Filesize
2.3MB

Download
memory/1856-5-0x00000000745F0000-0x0000000074A3B000-memory.dmp

Filesize
4.3MB

Download
memory/1856-7-0x0000000074608000-0x000000007484B000-memory.dmp

Filesize
2.3MB

Download