Analysis
-
max time kernel
91s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
14/10/2022, 09:18
Static task
static1
Behavioral task
behavioral1
Sample
aea6d3ce00ef4afcd389f4e79fda13d7810a77eda84cbe31f3e6e03ae304795b.dll
Resource
win7-20220901-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
aea6d3ce00ef4afcd389f4e79fda13d7810a77eda84cbe31f3e6e03ae304795b.dll
Resource
win10v2004-20220812-en
1 signatures
150 seconds
General
-
Target
aea6d3ce00ef4afcd389f4e79fda13d7810a77eda84cbe31f3e6e03ae304795b.dll
-
Size
171KB
-
MD5
57baa971b4bd88f4dc44297ac774cbb7
-
SHA1
af7d5b538bdfdbedb707d0b7a103a5f905d6f429
-
SHA256
aea6d3ce00ef4afcd389f4e79fda13d7810a77eda84cbe31f3e6e03ae304795b
-
SHA512
f8a589e0ffa0a1f497842ccbdbf6b778d8c98b904974e2f7198dad4c444e81a79d6ef978076f4aeba0f851837a5f8a79fa4b3210a19878c36189cb4260369836
-
SSDEEP
3072:XADzkVIQF7+v+/eVNGRR+gprl64Vo1L3Uc:XADoZ+vFqJldVo1X
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3956 wrote to memory of 2820 3956 rundll32.exe 81 PID 3956 wrote to memory of 2820 3956 rundll32.exe 81 PID 3956 wrote to memory of 2820 3956 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\aea6d3ce00ef4afcd389f4e79fda13d7810a77eda84cbe31f3e6e03ae304795b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\aea6d3ce00ef4afcd389f4e79fda13d7810a77eda84cbe31f3e6e03ae304795b.dll,#12⤵PID:2820
-