a6e797d1c8b081d7ce41f777a744eaf4ef15a9d574eec33cad4296c4c04560ee

Analysis

max time kernel
91s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 20:58

Target

ucmyqb.dll
Size

12.8MB
MD5

7a484f2b62bebd2b0ce404e36f768af5
SHA1

cbf166ce093f64ba2270b1adede89868ad15ad97
SHA256

89ed84f69d94e9674b45e924350ecc8ab953e7b1ebfcdf9438d24598e52197f2
SHA512

c40a0bcbc5b5001df39f083b253daf0ce65229a2f04c5e927d2f50c3ec5d6874f8f6ee1100a0a621fb49ed5a3938daa4e1d8db377ebd89a430956b9cf0744b14
SSDEEP

196608:frZ46+UTsubfbYzMTpsT+tkfW7qXObEYoMC1o6MiqhmWVAMn/x:frZ4gLbfbNpsCtkfC3K71+i+A

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1224	rundll32.exe
1224	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1452	1224	WerFault.exe	83

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1224	rundll32.exe
1224	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 1224	1604	rundll32.exe	83
PID 1604 wrote to memory of 1224	1604	rundll32.exe	83
PID 1604 wrote to memory of 1224	1604	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ucmyqb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ucmyqb.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:1224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1224 -s 704
    3⤵
    - Program crash
    PID:1452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1224 -ip 1224
1⤵
PID:2572

memory/1224-0-0x00000000010B0000-0x00000000010B1000-memory.dmp

Filesize
4KB

Download
memory/1224-1-0x0000000073CB5000-0x00000000742DE000-memory.dmp

Filesize
6.2MB

Download
memory/1224-2-0x00000000737F0000-0x0000000074FE2000-memory.dmp

Filesize
23.9MB

Download
memory/1224-4-0x0000000073CB5000-0x00000000742DE000-memory.dmp

Filesize
6.2MB

Download