Analysis
-
max time kernel
55s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
30-06-2022 19:44
Static task
static1
Behavioral task
behavioral1
Sample
5228300b603ba8166b0fb14ed7e8fd7ab68a65a5cbed6605c90bed847282cfa5.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
5228300b603ba8166b0fb14ed7e8fd7ab68a65a5cbed6605c90bed847282cfa5.dll
-
Size
426KB
-
MD5
42d2007c5c5a63e665e7e7afbb5c7f51
-
SHA1
d7bb0678ec9c47eefaf1ad2cd6c5851df8496ecb
-
SHA256
5228300b603ba8166b0fb14ed7e8fd7ab68a65a5cbed6605c90bed847282cfa5
-
SHA512
3e61c15c77bc62e60cd91c0d0cb9bc054c3dad7728047e9ad25b5bedb51ea00af5f07d7f08007b997e67161092b56c0c6b40feaed0419f8d2187e20839055fe9
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 1652 rundll32.exe 1652 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1960 wrote to memory of 1652 1960 rundll32.exe rundll32.exe PID 1960 wrote to memory of 1652 1960 rundll32.exe rundll32.exe PID 1960 wrote to memory of 1652 1960 rundll32.exe rundll32.exe PID 1960 wrote to memory of 1652 1960 rundll32.exe rundll32.exe PID 1960 wrote to memory of 1652 1960 rundll32.exe rundll32.exe PID 1960 wrote to memory of 1652 1960 rundll32.exe rundll32.exe PID 1960 wrote to memory of 1652 1960 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5228300b603ba8166b0fb14ed7e8fd7ab68a65a5cbed6605c90bed847282cfa5.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5228300b603ba8166b0fb14ed7e8fd7ab68a65a5cbed6605c90bed847282cfa5.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses