Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
08-05-2022 15:46
Behavioral task
behavioral1
Sample
637b4ea9086a057a5ae5d0a5b3111e01ddffb151802e4abf6d6f7258e5113a94.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
637b4ea9086a057a5ae5d0a5b3111e01ddffb151802e4abf6d6f7258e5113a94.dll
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
637b4ea9086a057a5ae5d0a5b3111e01ddffb151802e4abf6d6f7258e5113a94.dll
-
Size
488KB
-
MD5
1dba0c398327d3f315123d7070be77eb
-
SHA1
82de72c40c7ce20807f16615e4e08d507bea5cc6
-
SHA256
637b4ea9086a057a5ae5d0a5b3111e01ddffb151802e4abf6d6f7258e5113a94
-
SHA512
8e22324c1207b250fcc0ed3996e3f7a4eef1d50856c64f1e7d23bfcde950487ea075cebb3670468424a622038013fb34faf5c05fdd352605640494fa99a2fa91
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 1404 rundll32.exe 1404 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4716 wrote to memory of 1404 4716 rundll32.exe rundll32.exe PID 4716 wrote to memory of 1404 4716 rundll32.exe rundll32.exe PID 4716 wrote to memory of 1404 4716 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\637b4ea9086a057a5ae5d0a5b3111e01ddffb151802e4abf6d6f7258e5113a94.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\637b4ea9086a057a5ae5d0a5b3111e01ddffb151802e4abf6d6f7258e5113a94.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses