Analysis
-
max time kernel
11s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
21-10-2022 19:32
Static task
static1
Behavioral task
behavioral1
Sample
ac54420704a8e6381550cd3394cd11151c488d5548ce9d91b45e073a649c5ab3.dll
Resource
win7-20220812-en
2 signatures
150 seconds
General
-
Target
ac54420704a8e6381550cd3394cd11151c488d5548ce9d91b45e073a649c5ab3.dll
-
Size
222KB
-
MD5
1f38d3e3f6b3d9f3a1dec29283a0bb21
-
SHA1
10cb908d20609240a4521ee58c2475de03145329
-
SHA256
ac54420704a8e6381550cd3394cd11151c488d5548ce9d91b45e073a649c5ab3
-
SHA512
7daded363f17701903f890baaf3f52e03aaedcdcbf43b2a4d221d47efc39b42f198d8af4ad7149c86beac3839e713155529663e1886deddbfbba8051a151da79
-
SSDEEP
3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0f:jDgtfRQUHPw06MoV2nwTBlhm83
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1908 wrote to memory of 1492 1908 rundll32.exe rundll32.exe PID 1908 wrote to memory of 1492 1908 rundll32.exe rundll32.exe PID 1908 wrote to memory of 1492 1908 rundll32.exe rundll32.exe PID 1908 wrote to memory of 1492 1908 rundll32.exe rundll32.exe PID 1908 wrote to memory of 1492 1908 rundll32.exe rundll32.exe PID 1908 wrote to memory of 1492 1908 rundll32.exe rundll32.exe PID 1908 wrote to memory of 1492 1908 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac54420704a8e6381550cd3394cd11151c488d5548ce9d91b45e073a649c5ab3.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac54420704a8e6381550cd3394cd11151c488d5548ce9d91b45e073a649c5ab3.dll,#12⤵PID:1492