Analysis
-
max time kernel
44s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
09-07-2022 08:16
Static task
static1
Behavioral task
behavioral1
Sample
11f44531fb088d31307d87b01e8eabff/iroto.dll
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
11f44531fb088d31307d87b01e8eabff/iroto.dll
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
11f44531fb088d31307d87b01e8eabff/iroto1.dll
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
11f44531fb088d31307d87b01e8eabff/iroto1.dll
Resource
win10v2004-20220414-en
Behavioral task
behavioral5
Sample
11f44531fb088d31307d87b01e8eabff/research-1646684671.xls
Resource
win7-20220414-en
Behavioral task
behavioral6
Sample
11f44531fb088d31307d87b01e8eabff/research-1646684671.xls
Resource
win10v2004-20220414-en
General
-
Target
11f44531fb088d31307d87b01e8eabff/iroto.dll
-
Size
434KB
-
MD5
e03bde4862d4d93ac2ceed85abf50b18
-
SHA1
7d7c288a8cf7d4e5f64d616da699712b82760303
-
SHA256
055b9e9af987aec9ba7adb0eef947f39b516a213d663cc52a71c7f0af146a946
-
SHA512
12e8ef09745a562567dc3d18e3be72dac09120e7756d47d23a605a82499b1ed8ff471578f0f85a35685de13c93f1ad0834a89dce5d136527f731b5e170a520f1
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 780 wrote to memory of 1928 780 rundll32.exe rundll32.exe PID 780 wrote to memory of 1928 780 rundll32.exe rundll32.exe PID 780 wrote to memory of 1928 780 rundll32.exe rundll32.exe PID 780 wrote to memory of 1928 780 rundll32.exe rundll32.exe PID 780 wrote to memory of 1928 780 rundll32.exe rundll32.exe PID 780 wrote to memory of 1928 780 rundll32.exe rundll32.exe PID 780 wrote to memory of 1928 780 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\11f44531fb088d31307d87b01e8eabff\iroto.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\11f44531fb088d31307d87b01e8eabff\iroto.dll,#12⤵