dfab00a36630a17cf07c695e08770acce486f2623a1ddc6e1ee7239932ef72fb

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 05:22

Target

dfab00a36630a17cf07c695e08770acce486f2623a1ddc6e1ee7239932ef72fb.dll
Size

7.7MB
MD5

e460d93e3c51eac47fe9a75a52fe82bb
SHA1

ba86f21677d9325415b3d1739c993c48ef609948
SHA256

dfab00a36630a17cf07c695e08770acce486f2623a1ddc6e1ee7239932ef72fb
SHA512

b99d9b3c6c6d723009f62c7b122dafc5a84a2009c2c7531affdda384ad9ae1cdec80107be971e86198692e580e01d9854cfe7ebded2d816a06ca7520bccb13ae
SSDEEP

196608:6+knOFdsAsWobC+aRjbpNiFK3gntEAq0ldq3Y0mhh4IjCaG:6XkOfWqCNLQt1pbTLh9XG

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1216	rundll32.exe
1216	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1216	rundll32.exe
1216	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 1216	1520	rundll32.exe	28
PID 1520 wrote to memory of 1216	1520	rundll32.exe	28
PID 1520 wrote to memory of 1216	1520	rundll32.exe	28
PID 1520 wrote to memory of 1216	1520	rundll32.exe	28
PID 1520 wrote to memory of 1216	1520	rundll32.exe	28
PID 1520 wrote to memory of 1216	1520	rundll32.exe	28
PID 1520 wrote to memory of 1216	1520	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dfab00a36630a17cf07c695e08770acce486f2623a1ddc6e1ee7239932ef72fb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dfab00a36630a17cf07c695e08770acce486f2623a1ddc6e1ee7239932ef72fb.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:1216

memory/1216-4-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/1216-2-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/1216-0-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/1216-5-0x0000000070F40000-0x0000000072843000-memory.dmp

Filesize
25.0MB

Download
memory/1216-6-0x0000000071B9E000-0x0000000072098000-memory.dmp

Filesize
5.0MB

Download