Analysis
-
max time kernel
43s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
23-06-2022 17:56
Static task
static1
Behavioral task
behavioral1
Sample
1256-57-0x0000000000180000-0x00000000001A2000-memory.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1256-57-0x0000000000180000-0x00000000001A2000-memory.dll
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
1256-57-0x0000000000180000-0x00000000001A2000-memory.dll
-
Size
136KB
-
MD5
6150be7ae6ae3aa3e4483dad9e2626c3
-
SHA1
d8b9e593ede7fe806d5cc293e3b069e22d4e164e
-
SHA256
e0d641721bd11003cdb68045a011b31d90e3188415b2e770c04c1bb93411bbc3
-
SHA512
f15882ca19b9d8035b1a33cd99cfd21ff39c77821c31b2497e540db5ec9d5c5c15ffc869a884655f50a36c7bb9bfa41df9e78da6c615f9f97487541475ceb4c2
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1012 wrote to memory of 760 1012 rundll32.exe rundll32.exe PID 1012 wrote to memory of 760 1012 rundll32.exe rundll32.exe PID 1012 wrote to memory of 760 1012 rundll32.exe rundll32.exe PID 1012 wrote to memory of 760 1012 rundll32.exe rundll32.exe PID 1012 wrote to memory of 760 1012 rundll32.exe rundll32.exe PID 1012 wrote to memory of 760 1012 rundll32.exe rundll32.exe PID 1012 wrote to memory of 760 1012 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1256-57-0x0000000000180000-0x00000000001A2000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1256-57-0x0000000000180000-0x00000000001A2000-memory.dll,#12⤵PID:760