Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
01-02-2022 05:56
Static task
static1
Behavioral task
behavioral1
Sample
68acbe23860fcebf344008d37030ba4f3d2a4e2fb209a72a2142690a32ba020f.dll
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
68acbe23860fcebf344008d37030ba4f3d2a4e2fb209a72a2142690a32ba020f.dll
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
68acbe23860fcebf344008d37030ba4f3d2a4e2fb209a72a2142690a32ba020f.dll
-
Size
30KB
-
MD5
7a0ae9fabc401ba06f5e0900a7abed9b
-
SHA1
d39f9fb40153e0c9c381c76fce0a167759972924
-
SHA256
68acbe23860fcebf344008d37030ba4f3d2a4e2fb209a72a2142690a32ba020f
-
SHA512
f6c64cfbbf984ae46f95630f4d28c8098862f39e53e19cda077119a1f16ab2520956db3216911a44d835768e71291da9ef91e47d9d1706e406fb717efeb9a60f
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 14 IoCs
Processes:
rundll32.exeflow pid process 2 1668 rundll32.exe 4 1668 rundll32.exe 5 1668 rundll32.exe 6 1668 rundll32.exe 9 1668 rundll32.exe 10 1668 rundll32.exe 11 1668 rundll32.exe 12 1668 rundll32.exe 13 1668 rundll32.exe 14 1668 rundll32.exe 15 1668 rundll32.exe 16 1668 rundll32.exe 17 1668 rundll32.exe 18 1668 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1636 wrote to memory of 1668 1636 rundll32.exe rundll32.exe PID 1636 wrote to memory of 1668 1636 rundll32.exe rundll32.exe PID 1636 wrote to memory of 1668 1636 rundll32.exe rundll32.exe PID 1636 wrote to memory of 1668 1636 rundll32.exe rundll32.exe PID 1636 wrote to memory of 1668 1636 rundll32.exe rundll32.exe PID 1636 wrote to memory of 1668 1636 rundll32.exe rundll32.exe PID 1636 wrote to memory of 1668 1636 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\68acbe23860fcebf344008d37030ba4f3d2a4e2fb209a72a2142690a32ba020f.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\68acbe23860fcebf344008d37030ba4f3d2a4e2fb209a72a2142690a32ba020f.dll,#12⤵
- Blocklisted process makes network request
PID:1668
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1668-55-0x0000000076921000-0x0000000076923000-memory.dmpFilesize
8KB