Analysis
-
max time kernel
44s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
19-09-2022 04:50
Static task
static1
Behavioral task
behavioral1
Sample
28fbade373e203e422cef0e0ae6fd7972c608c1ab1565b1e6af91577a2ee8faa.dll
Resource
win7-20220901-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
28fbade373e203e422cef0e0ae6fd7972c608c1ab1565b1e6af91577a2ee8faa.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
28fbade373e203e422cef0e0ae6fd7972c608c1ab1565b1e6af91577a2ee8faa.dll
-
Size
3KB
-
MD5
0eceb80d5cce14d3745a561e8f63bc50
-
SHA1
816b5e968669b95bea439c16c839022f6c07b441
-
SHA256
28fbade373e203e422cef0e0ae6fd7972c608c1ab1565b1e6af91577a2ee8faa
-
SHA512
d4eb7a217ba277d4e8e4e0486c259e2c07f2cba037ea2e01de4622ed17ada4e9b9608681f6030dc900130cda9a4e21feaa6a67f8effea90672202ad7ba82cc90
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1280 wrote to memory of 1204 1280 rundll32.exe 27 PID 1280 wrote to memory of 1204 1280 rundll32.exe 27 PID 1280 wrote to memory of 1204 1280 rundll32.exe 27 PID 1280 wrote to memory of 1204 1280 rundll32.exe 27 PID 1280 wrote to memory of 1204 1280 rundll32.exe 27 PID 1280 wrote to memory of 1204 1280 rundll32.exe 27 PID 1280 wrote to memory of 1204 1280 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\28fbade373e203e422cef0e0ae6fd7972c608c1ab1565b1e6af91577a2ee8faa.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\28fbade373e203e422cef0e0ae6fd7972c608c1ab1565b1e6af91577a2ee8faa.dll,#12⤵PID:1204
-