Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28/10/2022, 17:47
Behavioral task
behavioral1
Sample
fcb17c3345cd9d95707f49c930c788e470fb15ec83430ea0d916bc54d29ff080.dll
Resource
win7-20220812-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
fcb17c3345cd9d95707f49c930c788e470fb15ec83430ea0d916bc54d29ff080.dll
Resource
win10v2004-20220812-en
2 signatures
150 seconds
General
-
Target
fcb17c3345cd9d95707f49c930c788e470fb15ec83430ea0d916bc54d29ff080.dll
-
Size
88KB
-
MD5
038db5406ed25197a3e54f9b7ee1d170
-
SHA1
ab47b5ed8d0de65364312fae69b3723e12ef2bed
-
SHA256
fcb17c3345cd9d95707f49c930c788e470fb15ec83430ea0d916bc54d29ff080
-
SHA512
964fb35be9a327966a77c2884fc72b574dc2c8d7cb416d07fd05c853be1e02c0348e2f65e63df59e46e75e3239fdbc90a46af026208e54619f3085ca40a13677
-
SSDEEP
1536:zMHSIHT9yM8vKOyNcwY8x+/XVMkTa7uNjYK+1dAul:z1QT0hvKOYd+/mhHJ
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4216-133-0x0000000010000000-0x000000001000E000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1868 wrote to memory of 4216 1868 rundll32.exe 80 PID 1868 wrote to memory of 4216 1868 rundll32.exe 80 PID 1868 wrote to memory of 4216 1868 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fcb17c3345cd9d95707f49c930c788e470fb15ec83430ea0d916bc54d29ff080.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fcb17c3345cd9d95707f49c930c788e470fb15ec83430ea0d916bc54d29ff080.dll,#12⤵PID:4216
-