Analysis
-
max time kernel
36s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
28/10/2022, 17:47
Behavioral task
behavioral1
Sample
fcb17c3345cd9d95707f49c930c788e470fb15ec83430ea0d916bc54d29ff080.dll
Resource
win7-20220812-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
fcb17c3345cd9d95707f49c930c788e470fb15ec83430ea0d916bc54d29ff080.dll
Resource
win10v2004-20220812-en
2 signatures
150 seconds
General
-
Target
fcb17c3345cd9d95707f49c930c788e470fb15ec83430ea0d916bc54d29ff080.dll
-
Size
88KB
-
MD5
038db5406ed25197a3e54f9b7ee1d170
-
SHA1
ab47b5ed8d0de65364312fae69b3723e12ef2bed
-
SHA256
fcb17c3345cd9d95707f49c930c788e470fb15ec83430ea0d916bc54d29ff080
-
SHA512
964fb35be9a327966a77c2884fc72b574dc2c8d7cb416d07fd05c853be1e02c0348e2f65e63df59e46e75e3239fdbc90a46af026208e54619f3085ca40a13677
-
SSDEEP
1536:zMHSIHT9yM8vKOyNcwY8x+/XVMkTa7uNjYK+1dAul:z1QT0hvKOYd+/mhHJ
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1612 wrote to memory of 788 1612 rundll32.exe 26 PID 1612 wrote to memory of 788 1612 rundll32.exe 26 PID 1612 wrote to memory of 788 1612 rundll32.exe 26 PID 1612 wrote to memory of 788 1612 rundll32.exe 26 PID 1612 wrote to memory of 788 1612 rundll32.exe 26 PID 1612 wrote to memory of 788 1612 rundll32.exe 26 PID 1612 wrote to memory of 788 1612 rundll32.exe 26
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fcb17c3345cd9d95707f49c930c788e470fb15ec83430ea0d916bc54d29ff080.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fcb17c3345cd9d95707f49c930c788e470fb15ec83430ea0d916bc54d29ff080.dll,#12⤵PID:788
-