Analysis
-
max time kernel
38s -
max time network
41s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
15-07-2022 23:37
Behavioral task
behavioral1
Sample
1148-57-0x00000000003A0000-0x00000000003C2000-memory.dll
Resource
win7-20220715-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
1148-57-0x00000000003A0000-0x00000000003C2000-memory.dll
Resource
win10v2004-20220414-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
1148-57-0x00000000003A0000-0x00000000003C2000-memory.dll
-
Size
136KB
-
MD5
8b2af8718c8f5345851db4aa077970ea
-
SHA1
d44f46f7573414f443e3e1e999b5fafd35292f1d
-
SHA256
e444d49db7239e7bb918d79f3b5b41facd76d913ac3baeb7d270d6a92b6a4d26
-
SHA512
0a10899a24fd8efcd8dd87f91fdd076e14aac88e03b3c19ac78702c8eed5914739388026d23eb1dfbcd7d8f9f2835b482988400139849037c25447ce89e37102
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1968 wrote to memory of 2016 1968 rundll32.exe rundll32.exe PID 1968 wrote to memory of 2016 1968 rundll32.exe rundll32.exe PID 1968 wrote to memory of 2016 1968 rundll32.exe rundll32.exe PID 1968 wrote to memory of 2016 1968 rundll32.exe rundll32.exe PID 1968 wrote to memory of 2016 1968 rundll32.exe rundll32.exe PID 1968 wrote to memory of 2016 1968 rundll32.exe rundll32.exe PID 1968 wrote to memory of 2016 1968 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1148-57-0x00000000003A0000-0x00000000003C2000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1148-57-0x00000000003A0000-0x00000000003C2000-memory.dll,#12⤵