Analysis
-
max time kernel
190s -
max time network
186s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/10/2022, 02:15
Behavioral task
behavioral1
Sample
e32a3d59ad24795341ed9303439af20247f0c22a7186b4142efbbb842f42502d.dll
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
e32a3d59ad24795341ed9303439af20247f0c22a7186b4142efbbb842f42502d.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
e32a3d59ad24795341ed9303439af20247f0c22a7186b4142efbbb842f42502d.dll
-
Size
20.1MB
-
MD5
67304371966b07ac685eda8fea08e05b
-
SHA1
5ff7dedd143def8594e9201404ae9af0e53bf2f2
-
SHA256
e32a3d59ad24795341ed9303439af20247f0c22a7186b4142efbbb842f42502d
-
SHA512
1562faf00b21bfccc476feae493748ef88ccb44a456c2137a17d73c29e007392a977161291f3ed1c4c5e9d785a4629bb56d8cee44c523f3f615ff2a023d9dddb
-
SSDEEP
1536:jf+RwQw6xnVKGO6cFEPjFTOpjj+O6cvt3Qd4f4muak2TeBqvqJ/B/L:7+Lw6xVKPpjj+Xwt3Qdi4mufBqvqJ/lL
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 3 956 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1320 wrote to memory of 956 1320 rundll32.exe 28 PID 1320 wrote to memory of 956 1320 rundll32.exe 28 PID 1320 wrote to memory of 956 1320 rundll32.exe 28 PID 1320 wrote to memory of 956 1320 rundll32.exe 28 PID 1320 wrote to memory of 956 1320 rundll32.exe 28 PID 1320 wrote to memory of 956 1320 rundll32.exe 28 PID 1320 wrote to memory of 956 1320 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e32a3d59ad24795341ed9303439af20247f0c22a7186b4142efbbb842f42502d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e32a3d59ad24795341ed9303439af20247f0c22a7186b4142efbbb842f42502d.dll,#12⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:956
-