Analysis
-
max time kernel
13s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
12-10-2022 22:27
Static task
static1
Behavioral task
behavioral1
Sample
e5913938a3d2eca68bbb52a2e997d35a8e6ae58325ad68e4be79b93e639f39de.dll
Resource
win7-20220812-en
windows7-x64
2 signatures
150 seconds
General
-
Target
e5913938a3d2eca68bbb52a2e997d35a8e6ae58325ad68e4be79b93e639f39de.dll
-
Size
329KB
-
MD5
69f22bd9958d721f61f60a1ebef6fb60
-
SHA1
34a8d8b57c8f3e6799ed37d817263c58b65ca3f9
-
SHA256
e5913938a3d2eca68bbb52a2e997d35a8e6ae58325ad68e4be79b93e639f39de
-
SHA512
9f6fcdefc76bd15b59f3be8eb028d54b11f1ead17589da9cb59474970169154aab1c72f011a3fe2e9932885e524fdd664ea2c19664732094de391d986b410983
-
SSDEEP
3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0s:jDgtfRQUHPw06MoV2nwTBlhm8k
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 976 wrote to memory of 384 976 rundll32.exe rundll32.exe PID 976 wrote to memory of 384 976 rundll32.exe rundll32.exe PID 976 wrote to memory of 384 976 rundll32.exe rundll32.exe PID 976 wrote to memory of 384 976 rundll32.exe rundll32.exe PID 976 wrote to memory of 384 976 rundll32.exe rundll32.exe PID 976 wrote to memory of 384 976 rundll32.exe rundll32.exe PID 976 wrote to memory of 384 976 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e5913938a3d2eca68bbb52a2e997d35a8e6ae58325ad68e4be79b93e639f39de.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e5913938a3d2eca68bbb52a2e997d35a8e6ae58325ad68e4be79b93e639f39de.dll,#12⤵