e22a65ee0428846fcf535e5ceaf77afe1a7c364eed69492c975b6924022100aa

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 10:59

Target

e22a65ee0428846fcf535e5ceaf77afe1a7c364eed69492c975b6924022100aa.dll
Size

4.3MB
MD5

2ef58336c6105f035fe560b77bc869fd
SHA1

bc9ea4255f31f51c60fe2e446ec5b40dd927a1c1
SHA256

e22a65ee0428846fcf535e5ceaf77afe1a7c364eed69492c975b6924022100aa
SHA512

d52877b209a3db829b5aefde0e8e76ca24c0b282587c4b2956140e5b830e03dbc332b8ea220debb652fdf580dda27f6d8b334cf23d3e1e1ec9aeb122acab383e
SSDEEP

98304:xAWzZQkQ5NC3FyYzMuRAaBggsqM6YkdoDW15sgu4ATU:OeQkQacgMA7Bwqi4oDI2t40U

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2320	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 2320	4684	rundll32.exe	83
PID 4684 wrote to memory of 2320	4684	rundll32.exe	83
PID 4684 wrote to memory of 2320	4684	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e22a65ee0428846fcf535e5ceaf77afe1a7c364eed69492c975b6924022100aa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e22a65ee0428846fcf535e5ceaf77afe1a7c364eed69492c975b6924022100aa.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:2320

memory/2320-0-0x00000000753F8000-0x000000007563B000-memory.dmp

Filesize
2.3MB

Download
memory/2320-1-0x00000000020D0000-0x00000000020D1000-memory.dmp

Filesize
4KB

Download
memory/2320-2-0x00000000753E0000-0x000000007582B000-memory.dmp

Filesize
4.3MB

Download