Analysis
-
max time kernel
841s -
max time network
841s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
16-12-2021 09:50
Static task
static1
Behavioral task
behavioral1
Sample
15097d2f74343c844eddaf977e411939b5060d9be365ac28b34c2c3d489f0b41.dll
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
15097d2f74343c844eddaf977e411939b5060d9be365ac28b34c2c3d489f0b41.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
15097d2f74343c844eddaf977e411939b5060d9be365ac28b34c2c3d489f0b41.dll
-
Size
522KB
-
MD5
84702bd6e798481f81066c1e0671ae03
-
SHA1
c53a1d8aa4495cb5acf07ddc069153fbecd37a91
-
SHA256
15097d2f74343c844eddaf977e411939b5060d9be365ac28b34c2c3d489f0b41
-
SHA512
802b350012e73bb3adbb59492d22db33cff7f67084975eb054f969908cab2826945a01f4086e08f88e176a1da2248b5c852d02d3f086c2a036ccddd286367fb4
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 972 wrote to memory of 1272 972 rundll32.exe 27 PID 972 wrote to memory of 1272 972 rundll32.exe 27 PID 972 wrote to memory of 1272 972 rundll32.exe 27 PID 972 wrote to memory of 1272 972 rundll32.exe 27 PID 972 wrote to memory of 1272 972 rundll32.exe 27 PID 972 wrote to memory of 1272 972 rundll32.exe 27 PID 972 wrote to memory of 1272 972 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\15097d2f74343c844eddaf977e411939b5060d9be365ac28b34c2c3d489f0b41.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\15097d2f74343c844eddaf977e411939b5060d9be365ac28b34c2c3d489f0b41.dll,#12⤵PID:1272
-