Analysis
-
max time kernel
137s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
24-07-2022 16:30
Behavioral task
behavioral1
Sample
58172dca112b9ac8ab686a2b65205a0618fecd85a227b9f271ffc907f863208a.dll
Resource
win7-20220718-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
58172dca112b9ac8ab686a2b65205a0618fecd85a227b9f271ffc907f863208a.dll
Resource
win10v2004-20220721-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
58172dca112b9ac8ab686a2b65205a0618fecd85a227b9f271ffc907f863208a.dll
-
Size
14KB
-
MD5
4a35670f74dedc80a63800b7a6359325
-
SHA1
a3e091ce807da2572fba42385330c72f99272548
-
SHA256
58172dca112b9ac8ab686a2b65205a0618fecd85a227b9f271ffc907f863208a
-
SHA512
0bc530960e7e8e61d392cc8ea4c35ea555eb51f15becb0ed8a4d9cc37c39a5b632d2a78a4f96f5e792216609e7ddcabfb3f99bc3150cebfbdfff95bf36627c6f
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 7 IoCs
Processes:
rundll32.exeflow pid process 8 4740 rundll32.exe 17 4740 rundll32.exe 30 4740 rundll32.exe 39 4740 rundll32.exe 54 4740 rundll32.exe 56 4740 rundll32.exe 60 4740 rundll32.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 4060 set thread context of 4740 4060 rundll32.exe rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1656 wrote to memory of 4060 1656 rundll32.exe rundll32.exe PID 1656 wrote to memory of 4060 1656 rundll32.exe rundll32.exe PID 1656 wrote to memory of 4060 1656 rundll32.exe rundll32.exe PID 4060 wrote to memory of 4740 4060 rundll32.exe rundll32.exe PID 4060 wrote to memory of 4740 4060 rundll32.exe rundll32.exe PID 4060 wrote to memory of 4740 4060 rundll32.exe rundll32.exe PID 4060 wrote to memory of 4740 4060 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\58172dca112b9ac8ab686a2b65205a0618fecd85a227b9f271ffc907f863208a.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\58172dca112b9ac8ab686a2b65205a0618fecd85a227b9f271ffc907f863208a.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe3⤵
- Blocklisted process makes network request