Analysis
-
max time kernel
126s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
02/05/2022, 00:12
Static task
static1
Behavioral task
behavioral1
Sample
29c062ee6df61733f00c39c3290c58a33c1eea61b5fbf2a8560b57b5b689440b.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
29c062ee6df61733f00c39c3290c58a33c1eea61b5fbf2a8560b57b5b689440b.dll
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
29c062ee6df61733f00c39c3290c58a33c1eea61b5fbf2a8560b57b5b689440b.dll
-
Size
3.3MB
-
MD5
f2b1412c63ab313adbef1d480583ea37
-
SHA1
d02b5032d725c104b3eafb476dad23f9958755ae
-
SHA256
29c062ee6df61733f00c39c3290c58a33c1eea61b5fbf2a8560b57b5b689440b
-
SHA512
2daf692dbbaa6d60a439c86a95e65f2e47d7df2f57a71ccddf0728bd7d481915550996e3f68dffdeaa0ee813206b5b1ef76febcd47f26ad0fde77162c3859df3
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1456 rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1456 rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3556 wrote to memory of 1456 3556 rundll32.exe 80 PID 3556 wrote to memory of 1456 3556 rundll32.exe 80 PID 3556 wrote to memory of 1456 3556 rundll32.exe 80 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82 PID 1456 wrote to memory of 2340 1456 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\29c062ee6df61733f00c39c3290c58a33c1eea61b5fbf2a8560b57b5b689440b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\29c062ee6df61733f00c39c3290c58a33c1eea61b5fbf2a8560b57b5b689440b.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\SysWOW64\extrac32.exe"C:\Windows\system32\extrac32.exe"3⤵PID:2340
-
-