d3ab2fd2c5734f1765082547095fbc23f6df2c38a2beb8694b19dac8ccc9008a

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 03:00

Target

blitzhub.dll
Size

658KB
MD5

994ac1f5637594c73969e2ddd8f4c702
SHA1

659a002195c6248468911478a14ac169b5cb5228
SHA256

fe5b99a8c7e2974c7f13fc2c926827a77664e15465bd7b2b98b8ae92c762aaf1
SHA512

cb86d61caca7b60891a2f3a66e3e6832e11fdb6100ce8e6769c5fb141f3307bac6f5977d68f9dd2218e2dd22db7b1885b79f7fe413cc85aec895ad7b2ba7020a
SSDEEP

12288:QShmW5wwyPImzQ/+afpnRyY9jjU8TUDvRvrlPLCZ1Bh+qlTGqIZ/:QShm0wwuFQZfpcYRzINv5ohRTGqU

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1628	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1628	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 1628	1252	rundll32.exe	30
PID 1252 wrote to memory of 1628	1252	rundll32.exe	30
PID 1252 wrote to memory of 1628	1252	rundll32.exe	30
PID 1252 wrote to memory of 1628	1252	rundll32.exe	30
PID 1252 wrote to memory of 1628	1252	rundll32.exe	30
PID 1252 wrote to memory of 1628	1252	rundll32.exe	30
PID 1252 wrote to memory of 1628	1252	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\blitzhub.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\blitzhub.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetWindowsHookEx
  PID:1628

memory/1628-0-0x0000000002140000-0x000000000254F000-memory.dmp

Filesize
4.1MB

Download
memory/1628-2-0x0000000002140000-0x000000000254F000-memory.dmp

Filesize
4.1MB

Download
memory/1628-4-0x0000000002140000-0x000000000254F000-memory.dmp

Filesize
4.1MB

Download
memory/1628-5-0x00000000024AB000-0x000000000254F000-memory.dmp

Filesize
656KB

Download
memory/1628-3-0x0000000002140000-0x000000000254F000-memory.dmp

Filesize
4.1MB

Download
memory/1628-1-0x0000000002140000-0x000000000254F000-memory.dmp

Filesize
4.1MB

Download
memory/1628-7-0x0000000002140000-0x000000000254F000-memory.dmp

Filesize
4.1MB

Download