Analysis
-
max time kernel
38s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04/10/2022, 06:41
Static task
static1
Behavioral task
behavioral1
Sample
5c06b54ce0c17bf84ce29b9eb5f05e1388036baa7506a38adc2217e6fa0a07d3.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5c06b54ce0c17bf84ce29b9eb5f05e1388036baa7506a38adc2217e6fa0a07d3.dll
Resource
win10v2004-20220812-en
General
-
Target
5c06b54ce0c17bf84ce29b9eb5f05e1388036baa7506a38adc2217e6fa0a07d3.dll
-
Size
86KB
-
MD5
27c42d1ede412ef7d91405eaeb6b0a84
-
SHA1
0058af1c26e9a53ac059f48a15a6452d606d64ad
-
SHA256
5c06b54ce0c17bf84ce29b9eb5f05e1388036baa7506a38adc2217e6fa0a07d3
-
SHA512
c9468fff3593fa6fa096f88d3d9a261259b601487d66ed3029ac693baac2ba1ec08025e7fd4b2cb5aaeb820b5f01053bb38249477dee68dd1bc47db61c12b444
-
SSDEEP
1536:E7fzY+VfUJ2v+CERq46Ji79LtXA+ZpgCiIQMOxpx8i:mLYQfUG+rR2G58Mqpx8
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 752 wrote to memory of 1652 752 rundll32.exe 27 PID 752 wrote to memory of 1652 752 rundll32.exe 27 PID 752 wrote to memory of 1652 752 rundll32.exe 27 PID 752 wrote to memory of 1652 752 rundll32.exe 27 PID 752 wrote to memory of 1652 752 rundll32.exe 27 PID 752 wrote to memory of 1652 752 rundll32.exe 27 PID 752 wrote to memory of 1652 752 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5c06b54ce0c17bf84ce29b9eb5f05e1388036baa7506a38adc2217e6fa0a07d3.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5c06b54ce0c17bf84ce29b9eb5f05e1388036baa7506a38adc2217e6fa0a07d3.dll,#12⤵PID:1652
-