Analysis
-
max time kernel
47s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
11-10-2022 16:45
Static task
static1
Behavioral task
behavioral1
Sample
95849e615b434611a2e58c1a04eab2ac42337c01ac5e7635cb30f126fbd19182.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
95849e615b434611a2e58c1a04eab2ac42337c01ac5e7635cb30f126fbd19182.dll
Resource
win10v2004-20220901-en
General
-
Target
95849e615b434611a2e58c1a04eab2ac42337c01ac5e7635cb30f126fbd19182.dll
-
Size
74KB
-
MD5
687abf70dd81c0bae9473367159518f8
-
SHA1
86aff7a316adcefd8b51dff67fb20c929bff7027
-
SHA256
95849e615b434611a2e58c1a04eab2ac42337c01ac5e7635cb30f126fbd19182
-
SHA512
107dca24f485c9ebce6ff7ab46e49b5fefac0acca51deb8c3266f71e5b4988b73fec03698bb161df6c350c31a471f30b238b135886bf9f8ba6fe3c721c54a572
-
SSDEEP
1536:Ad/Pc2bTeGECQtoPH2mQ2ZSXY7BNWxlhVnY6b+OneoWS6h:Am2oCQtIWmQPXe8HnY6+vhNh
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1768 wrote to memory of 1112 1768 rundll32.exe 27 PID 1768 wrote to memory of 1112 1768 rundll32.exe 27 PID 1768 wrote to memory of 1112 1768 rundll32.exe 27 PID 1768 wrote to memory of 1112 1768 rundll32.exe 27 PID 1768 wrote to memory of 1112 1768 rundll32.exe 27 PID 1768 wrote to memory of 1112 1768 rundll32.exe 27 PID 1768 wrote to memory of 1112 1768 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\95849e615b434611a2e58c1a04eab2ac42337c01ac5e7635cb30f126fbd19182.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\95849e615b434611a2e58c1a04eab2ac42337c01ac5e7635cb30f126fbd19182.dll,#12⤵PID:1112
-