Analysis
-
max time kernel
150s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
12-07-2022 08:22
Static task
static1
Behavioral task
behavioral1
Sample
1828-57-0x0000000000930000-0x0000000000952000-memory.dll
Resource
win7-20220414-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1828-57-0x0000000000930000-0x0000000000952000-memory.dll
Resource
win10v2004-20220414-en
0 signatures
0 seconds
General
-
Target
1828-57-0x0000000000930000-0x0000000000952000-memory.dll
-
Size
136KB
-
MD5
059ce6d186be0f4ff1b0723539932532
-
SHA1
c9ca4680a60c631d11df101bcd710d0ed47762bc
-
SHA256
8c02f7331313feac02997d2adf3b0d4d77cb6712b1d3b3f576d715acba55411c
-
SHA512
651d5fa44007263c0b02ea16a454629c3ea7eb4cad136d4e0bd94cfbb1128639eb105f97350fce9269d61a8145859554d39a578601b8d13a7a840dd1673b333c
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
rundll32.exerundll32.exerundll32.exerundll32.exerundll32.exedescription pid process target process PID 2588 wrote to memory of 3676 2588 rundll32.exe rundll32.exe PID 2588 wrote to memory of 3676 2588 rundll32.exe rundll32.exe PID 2588 wrote to memory of 3676 2588 rundll32.exe rundll32.exe PID 3676 wrote to memory of 1832 3676 rundll32.exe rundll32.exe PID 3676 wrote to memory of 1832 3676 rundll32.exe rundll32.exe PID 3676 wrote to memory of 1832 3676 rundll32.exe rundll32.exe PID 1832 wrote to memory of 1196 1832 rundll32.exe rundll32.exe PID 1832 wrote to memory of 1196 1832 rundll32.exe rundll32.exe PID 1832 wrote to memory of 1196 1832 rundll32.exe rundll32.exe PID 1196 wrote to memory of 1348 1196 rundll32.exe rundll32.exe PID 1196 wrote to memory of 1348 1196 rundll32.exe rundll32.exe PID 1196 wrote to memory of 1348 1196 rundll32.exe rundll32.exe PID 1348 wrote to memory of 2432 1348 rundll32.exe rundll32.exe PID 1348 wrote to memory of 2432 1348 rundll32.exe rundll32.exe PID 1348 wrote to memory of 2432 1348 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1828-57-0x0000000000930000-0x0000000000952000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1828-57-0x0000000000930000-0x0000000000952000-memory.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1828-57-0x0000000000930000-0x0000000000952000-memory.dll,#13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1828-57-0x0000000000930000-0x0000000000952000-memory.dll,#14⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1828-57-0x0000000000930000-0x0000000000952000-memory.dll,#15⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1828-57-0x0000000000930000-0x0000000000952000-memory.dll,#16⤵