Analysis
-
max time kernel
47s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
12-07-2022 07:27
Static task
static1
Behavioral task
behavioral1
Sample
1348-57-0x0000000000310000-0x0000000000332000-memory.dll
Resource
win7-20220414-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1348-57-0x0000000000310000-0x0000000000332000-memory.dll
Resource
win10v2004-20220414-en
0 signatures
0 seconds
General
-
Target
1348-57-0x0000000000310000-0x0000000000332000-memory.dll
-
Size
136KB
-
MD5
81fb48496f3b2aa9d70a1d1f83a4789b
-
SHA1
019e4cb9cf8eadbabb4a934e5289dfb4b2e7e975
-
SHA256
68a7b098f6fb7a75ea412aac026b4cc116c2e70f1e4834784fae204b0bb704ba
-
SHA512
976229a565b9e5e17889b5c8bb206aeeae25a1620f6491c766d1e5e4c69e0b9b74108c2a77bcc054aee1d12744429796dd9c73365e4142144421ae8e13d5443e
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 632 wrote to memory of 1628 632 rundll32.exe rundll32.exe PID 632 wrote to memory of 1628 632 rundll32.exe rundll32.exe PID 632 wrote to memory of 1628 632 rundll32.exe rundll32.exe PID 632 wrote to memory of 1628 632 rundll32.exe rundll32.exe PID 632 wrote to memory of 1628 632 rundll32.exe rundll32.exe PID 632 wrote to memory of 1628 632 rundll32.exe rundll32.exe PID 632 wrote to memory of 1628 632 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1348-57-0x0000000000310000-0x0000000000332000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1348-57-0x0000000000310000-0x0000000000332000-memory.dll,#12⤵