a6e797d1c8b081d7ce41f777a744eaf4ef15a9d574eec33cad4296c4c04560ee

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 20:58

Target

ucmyqb.dll
Size

12.8MB
MD5

7a484f2b62bebd2b0ce404e36f768af5
SHA1

cbf166ce093f64ba2270b1adede89868ad15ad97
SHA256

89ed84f69d94e9674b45e924350ecc8ab953e7b1ebfcdf9438d24598e52197f2
SHA512

c40a0bcbc5b5001df39f083b253daf0ce65229a2f04c5e927d2f50c3ec5d6874f8f6ee1100a0a621fb49ed5a3938daa4e1d8db377ebd89a430956b9cf0744b14
SSDEEP

196608:frZ46+UTsubfbYzMTpsT+tkfW7qXObEYoMC1o6MiqhmWVAMn/x:frZ4gLbfbNpsCtkfC3K71+i+A

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2368	rundll32.exe
2368	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2204	2368	WerFault.exe	30

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2368	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2368	2180	rundll32.exe	30
PID 2180 wrote to memory of 2368	2180	rundll32.exe	30
PID 2180 wrote to memory of 2368	2180	rundll32.exe	30
PID 2180 wrote to memory of 2368	2180	rundll32.exe	30
PID 2180 wrote to memory of 2368	2180	rundll32.exe	30
PID 2180 wrote to memory of 2368	2180	rundll32.exe	30
PID 2180 wrote to memory of 2368	2180	rundll32.exe	30
PID 2368 wrote to memory of 2204	2368	rundll32.exe	31
PID 2368 wrote to memory of 2204	2368	rundll32.exe	31
PID 2368 wrote to memory of 2204	2368	rundll32.exe	31
PID 2368 wrote to memory of 2204	2368	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ucmyqb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ucmyqb.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 288
    3⤵
    - Program crash
    PID:2204

memory/2368-4-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/2368-2-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/2368-0-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/2368-5-0x00000000708D5000-0x0000000070EFE000-memory.dmp

Filesize
6.2MB

Download
memory/2368-7-0x0000000070410000-0x0000000071C02000-memory.dmp

Filesize
23.9MB

Download
memory/2368-8-0x00000000708D5000-0x0000000070EFE000-memory.dmp

Filesize
6.2MB

Download