Analysis
-
max time kernel
132s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20-10-2022 21:20
Static task
static1
Behavioral task
behavioral1
Sample
155e9ce894eef64620a880f781c09ff8c920642c6e96a35b44ab9c011abc8694.dll
Resource
win7-20220812-en
2 signatures
150 seconds
General
-
Target
155e9ce894eef64620a880f781c09ff8c920642c6e96a35b44ab9c011abc8694.dll
-
Size
606KB
-
MD5
90209afaf1036c1f0f241460b3078c20
-
SHA1
53b993653dd3bf0d11c546304cfb599b17be4659
-
SHA256
155e9ce894eef64620a880f781c09ff8c920642c6e96a35b44ab9c011abc8694
-
SHA512
9c6e1592aaaab63050a1b2cf634ecb315647b735faf26d819cbf7f8d120ce4f1d8339369a2cad60dba658279f673720da954545d8aaabcc6d36dff228486525a
-
SSDEEP
3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0z:jDgtfRQUHPw06MoV2nwTBlhm87
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1952 wrote to memory of 4744 1952 rundll32.exe rundll32.exe PID 1952 wrote to memory of 4744 1952 rundll32.exe rundll32.exe PID 1952 wrote to memory of 4744 1952 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\155e9ce894eef64620a880f781c09ff8c920642c6e96a35b44ab9c011abc8694.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\155e9ce894eef64620a880f781c09ff8c920642c6e96a35b44ab9c011abc8694.dll,#12⤵PID:4744