Analysis
- max time kernel
128s - max time network
133s - platform
windows7_x64 - resource
win7-en-20211104 - submitted
24/11/2021, 15:37
Static task
static1
Behavioral task
behavioral1
Sample
3a8acc008eaad0a94e3b5fbd200028fa342773869b3f7f7edf772adbfb52d789.dll
Resource
win7-en-20211104
windows7_x64
0 signatures
0 seconds
General
- Target 3a8acc008eaad0a94e3b5fbd200028fa342773869b3f7f7edf772adbfb52d789.dll
- Size 416KB
- Sample211124-s2g4bagcb6
- SHA256 3a8acc008eaad0a94e3b5fbd200028fa342773869b3f7f7edf772adbfb52d789
- MD5 b65325cbe036c4e86a94428d8e7fab49
- SHA1 8788e13d2a0fad0a31f5a48613d2fcbd521d0d2e
- SHA512 47878f9d331163c0729302a1d254be7d06e5a385261e575b0764693714c3c91a1a627c6b968594b8b71406bb1475ec510487d1596540ac1c5c48734f94aa188f
- MD5 SHA1 SHA512
Malware Config
Signatures
- Blocklisted process makes network request 11 IoCs
flow pid Process 4 304 rundll32.exe 5 304 rundll32.exe 7 304 rundll32.exe 8 304 rundll32.exe 9 304 rundll32.exe 10 304 rundll32.exe 13 304 rundll32.exe 14 304 rundll32.exe 17 304 rundll32.exe 19 304 rundll32.exe 21 304 rundll32.exe - Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 304 rundll32.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1600 wrote to memory of 948 1600 rundll32.exe 27 PID 1600 wrote to memory of 948 1600 rundll32.exe 27 PID 1600 wrote to memory of 948 1600 rundll32.exe 27 PID 1600 wrote to memory of 948 1600 rundll32.exe 27 PID 1600 wrote to memory of 948 1600 rundll32.exe 27 PID 1600 wrote to memory of 948 1600 rundll32.exe 27 PID 1600 wrote to memory of 948 1600 rundll32.exe 27 PID 948 wrote to memory of 364 948 rundll32.exe 29 PID 948 wrote to memory of 364 948 rundll32.exe 29 PID 948 wrote to memory of 364 948 rundll32.exe 29 PID 948 wrote to memory of 364 948 rundll32.exe 29 PID 948 wrote to memory of 364 948 rundll32.exe 29 PID 948 wrote to memory of 364 948 rundll32.exe 29 PID 948 wrote to memory of 364 948 rundll32.exe 29 PID 364 wrote to memory of 1504 364 rundll32.exe 30 PID 364 wrote to memory of 1504 364 rundll32.exe 30 PID 364 wrote to memory of 1504 364 rundll32.exe 30 PID 364 wrote to memory of 1504 364 rundll32.exe 30 PID 364 wrote to memory of 1504 364 rundll32.exe 30 PID 364 wrote to memory of 1504 364 rundll32.exe 30 PID 364 wrote to memory of 1504 364 rundll32.exe 30 PID 1504 wrote to memory of 304 1504 rundll32.exe 31 PID 1504 wrote to memory of 304 1504 rundll32.exe 31 PID 1504 wrote to memory of 304 1504 rundll32.exe 31 PID 1504 wrote to memory of 304 1504 rundll32.exe 31 PID 1504 wrote to memory of 304 1504 rundll32.exe 31 PID 1504 wrote to memory of 304 1504 rundll32.exe 31 PID 1504 wrote to memory of 304 1504 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a8acc008eaad0a94e3b5fbd200028fa342773869b3f7f7edf772adbfb52d789.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a8acc008eaad0a94e3b5fbd200028fa342773869b3f7f7edf772adbfb52d789.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a8acc008eaad0a94e3b5fbd200028fa342773869b3f7f7edf772adbfb52d789.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\3a8acc008eaad0a94e3b5fbd200028fa342773869b3f7f7edf772adbfb52d789.dll",Control_RunDLL4⤵
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\3a8acc008eaad0a94e3b5fbd200028fa342773869b3f7f7edf772adbfb52d789.dll",Control_RunDLL5⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:304
-
-
-
-