Analysis
- max time kernel
125s - max time network
127s - platform
windows7_x64 - resource
win7-en-20211104 - submitted
24/11/2021, 15:39
Static task
static1
Behavioral task
behavioral1
Sample
56547488fb182b73f83211903ce2dd30.dll
Resource
win7-en-20211104
windows7_x64
0 signatures
0 seconds
General
- Target 56547488fb182b73f83211903ce2dd30.dll
- Size 416KB
- Sample211124-s3l4nagcc2
- SHA256 bf0cadbc8a6b28a54eb0db5f2afe582a02d5f1dedb058097abc1d7b43ba7deb0
- MD5 56547488fb182b73f83211903ce2dd30
- SHA1 e3c962932fb99e7685ea989356d60afc4045c52f
- SHA512 f1d4ae06426e597af23e21d97946812d9bb7d546687cd53b8efec73a82216f998e9c4f7556cf6791aa1b3d32787c57056777a3bde6563ac5b7b51b48f0455dce
- MD5 SHA1 SHA512
Malware Config
Signatures
- Blocklisted process makes network request 11 IoCs
flow pid Process 4 1372 rundll32.exe 5 1372 rundll32.exe 7 1372 rundll32.exe 8 1372 rundll32.exe 9 1372 rundll32.exe 10 1372 rundll32.exe 13 1372 rundll32.exe 14 1372 rundll32.exe 15 1372 rundll32.exe 19 1372 rundll32.exe 21 1372 rundll32.exe - Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1372 rundll32.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 592 wrote to memory of 320 592 rundll32.exe 28 PID 592 wrote to memory of 320 592 rundll32.exe 28 PID 592 wrote to memory of 320 592 rundll32.exe 28 PID 592 wrote to memory of 320 592 rundll32.exe 28 PID 592 wrote to memory of 320 592 rundll32.exe 28 PID 592 wrote to memory of 320 592 rundll32.exe 28 PID 592 wrote to memory of 320 592 rundll32.exe 28 PID 320 wrote to memory of 584 320 rundll32.exe 29 PID 320 wrote to memory of 584 320 rundll32.exe 29 PID 320 wrote to memory of 584 320 rundll32.exe 29 PID 320 wrote to memory of 584 320 rundll32.exe 29 PID 320 wrote to memory of 584 320 rundll32.exe 29 PID 320 wrote to memory of 584 320 rundll32.exe 29 PID 320 wrote to memory of 584 320 rundll32.exe 29 PID 584 wrote to memory of 900 584 rundll32.exe 30 PID 584 wrote to memory of 900 584 rundll32.exe 30 PID 584 wrote to memory of 900 584 rundll32.exe 30 PID 584 wrote to memory of 900 584 rundll32.exe 30 PID 584 wrote to memory of 900 584 rundll32.exe 30 PID 584 wrote to memory of 900 584 rundll32.exe 30 PID 584 wrote to memory of 900 584 rundll32.exe 30 PID 900 wrote to memory of 1372 900 rundll32.exe 31 PID 900 wrote to memory of 1372 900 rundll32.exe 31 PID 900 wrote to memory of 1372 900 rundll32.exe 31 PID 900 wrote to memory of 1372 900 rundll32.exe 31 PID 900 wrote to memory of 1372 900 rundll32.exe 31 PID 900 wrote to memory of 1372 900 rundll32.exe 31 PID 900 wrote to memory of 1372 900 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\56547488fb182b73f83211903ce2dd30.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:592 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\56547488fb182b73f83211903ce2dd30.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\56547488fb182b73f83211903ce2dd30.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:584 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\56547488fb182b73f83211903ce2dd30.dll",Control_RunDLL4⤵
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\56547488fb182b73f83211903ce2dd30.dll",Control_RunDLL5⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1372
-
-
-
-