Analysis
-
max time kernel
103s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04-10-2022 15:41
Static task
static1
Behavioral task
behavioral1
Sample
4976727b780e87d5c4083936088394d9.dll
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
4976727b780e87d5c4083936088394d9.dll
Resource
win10v2004-20220901-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
4976727b780e87d5c4083936088394d9.dll
-
Size
672KB
-
MD5
4976727b780e87d5c4083936088394d9
-
SHA1
af2848a78e98f2409f23a509fc826f100b29f6db
-
SHA256
50cbe7e1ac258722c9ca2a96593ef18654ab54adb21523cfef83581747b3051b
-
SHA512
4fec9d42475b562a516283c4a40ceeeee7ffd655127ad90ac6f1e3da4587bc449d7a2e9a746bbb9bb884ffe3b0285de264d03e08cc6be9cbeae238000efa5069
-
SSDEEP
12288:hkgJSzrCEhwrC8yIJrlwgOW9xwMGwy0w7w4wJ+wwwZwb8bewf+HwddBlvK:hkgIPXR0gI7K
Score
10/10
Malware Config
Extracted
Family
icedid
Campaign
2399258081
C2
eysneolissionsm.com
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 2 964 rundll32.exe 4 964 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 964 rundll32.exe 964 rundll32.exe