691670dd409760fe43086cb69ca92621b25dc8e5a7b8181f15abc97f717b2e91

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 14:26

Target

SecuriteInfo.com.Trojan.Packed2.47113.2909.11487.dll
Size

25.9MB
MD5

b47c3523a8f7ad6ea426c556a177b32f
SHA1

34fad2e733afeb58ed3c877a58ca53a6ff8ffacc
SHA256

691670dd409760fe43086cb69ca92621b25dc8e5a7b8181f15abc97f717b2e91
SHA512

31e213fc7d35d08ca13e7621e3a4b744147f65e6d2d0871dd05de76cf06aaeb64af9b3ed5cccbdc7eda169a7c7729030a4069525ee304e93b82a5a272b92b6b8
SSDEEP

393216:C3PFvkKEu0q464uvSyaiswEypQUrfGACXUVgFLq9388BdES8KK:vYacEyOdagFLq93HH

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2528	rundll32.exe
2528	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2912	2528	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2528	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2528	2884	rundll32.exe	28
PID 2884 wrote to memory of 2528	2884	rundll32.exe	28
PID 2884 wrote to memory of 2528	2884	rundll32.exe	28
PID 2884 wrote to memory of 2528	2884	rundll32.exe	28
PID 2884 wrote to memory of 2528	2884	rundll32.exe	28
PID 2884 wrote to memory of 2528	2884	rundll32.exe	28
PID 2884 wrote to memory of 2528	2884	rundll32.exe	28
PID 2528 wrote to memory of 2912	2528	rundll32.exe	29
PID 2528 wrote to memory of 2912	2528	rundll32.exe	29
PID 2528 wrote to memory of 2912	2528	rundll32.exe	29
PID 2528 wrote to memory of 2912	2528	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Packed2.47113.2909.11487.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Packed2.47113.2909.11487.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 272
    3⤵
    - Program crash
    PID:2912

memory/2528-4-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2528-5-0x0000000070B8D000-0x0000000071448000-memory.dmp

Filesize
8.7MB

Download
memory/2528-2-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2528-0-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2528-6-0x0000000070390000-0x0000000071D8D000-memory.dmp

Filesize
26.0MB

Download
memory/2528-7-0x0000000070B8D000-0x0000000071448000-memory.dmp

Filesize
8.7MB

Download