691670dd409760fe43086cb69ca92621b25dc8e5a7b8181f15abc97f717b2e91

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2024, 14:26

Target

SecuriteInfo.com.Trojan.Packed2.47113.2909.11487.dll
Size

25.9MB
MD5

b47c3523a8f7ad6ea426c556a177b32f
SHA1

34fad2e733afeb58ed3c877a58ca53a6ff8ffacc
SHA256

691670dd409760fe43086cb69ca92621b25dc8e5a7b8181f15abc97f717b2e91
SHA512

31e213fc7d35d08ca13e7621e3a4b744147f65e6d2d0871dd05de76cf06aaeb64af9b3ed5cccbdc7eda169a7c7729030a4069525ee304e93b82a5a272b92b6b8
SSDEEP

393216:C3PFvkKEu0q464uvSyaiswEypQUrfGACXUVgFLq9388BdES8KK:vYacEyOdagFLq93HH

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
396	rundll32.exe
396	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1992	396	WerFault.exe	82

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
396	rundll32.exe
396	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 396	1552	rundll32.exe	82
PID 1552 wrote to memory of 396	1552	rundll32.exe	82
PID 1552 wrote to memory of 396	1552	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Packed2.47113.2909.11487.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Packed2.47113.2909.11487.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 680
    3⤵
    - Program crash
    PID:1992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 396 -ip 396
1⤵
PID:872

memory/396-0-0x0000000000740000-0x0000000000741000-memory.dmp

Filesize
4KB

Download
memory/396-1-0x000000007406D000-0x0000000074928000-memory.dmp

Filesize
8.7MB

Download
memory/396-2-0x0000000073870000-0x000000007526D000-memory.dmp

Filesize
26.0MB

Download
memory/396-3-0x000000007406D000-0x0000000074928000-memory.dmp

Filesize
8.7MB

Download