Analysis
-
max time kernel
91s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
12-07-2022 08:20
Static task
static1
Behavioral task
behavioral1
Sample
1828-57-0x0000000000930000-0x0000000000952000-memory.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1828-57-0x0000000000930000-0x0000000000952000-memory.dll
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
1828-57-0x0000000000930000-0x0000000000952000-memory.dll
-
Size
136KB
-
MD5
059ce6d186be0f4ff1b0723539932532
-
SHA1
c9ca4680a60c631d11df101bcd710d0ed47762bc
-
SHA256
8c02f7331313feac02997d2adf3b0d4d77cb6712b1d3b3f576d715acba55411c
-
SHA512
651d5fa44007263c0b02ea16a454629c3ea7eb4cad136d4e0bd94cfbb1128639eb105f97350fce9269d61a8145859554d39a578601b8d13a7a840dd1673b333c
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
rundll32.exerundll32.exerundll32.exerundll32.exedescription pid process target process PID 4776 wrote to memory of 1328 4776 rundll32.exe rundll32.exe PID 4776 wrote to memory of 1328 4776 rundll32.exe rundll32.exe PID 4776 wrote to memory of 1328 4776 rundll32.exe rundll32.exe PID 1328 wrote to memory of 3352 1328 rundll32.exe rundll32.exe PID 1328 wrote to memory of 3352 1328 rundll32.exe rundll32.exe PID 1328 wrote to memory of 3352 1328 rundll32.exe rundll32.exe PID 3352 wrote to memory of 548 3352 rundll32.exe rundll32.exe PID 3352 wrote to memory of 548 3352 rundll32.exe rundll32.exe PID 3352 wrote to memory of 548 3352 rundll32.exe rundll32.exe PID 548 wrote to memory of 5068 548 rundll32.exe rundll32.exe PID 548 wrote to memory of 5068 548 rundll32.exe rundll32.exe PID 548 wrote to memory of 5068 548 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1828-57-0x0000000000930000-0x0000000000952000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1828-57-0x0000000000930000-0x0000000000952000-memory.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1828-57-0x0000000000930000-0x0000000000952000-memory.dll,#13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1828-57-0x0000000000930000-0x0000000000952000-memory.dll,#14⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1828-57-0x0000000000930000-0x0000000000952000-memory.dll,#15⤵