Analysis
-
max time kernel
91s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
30-10-2022 14:02
Static task
static1
Behavioral task
behavioral1
Sample
979ca66179a9632e5308084fc289ce2b19c6b408cc5ec9a73196250637d9a4ca.dll
Resource
win7-20220812-en
2 signatures
150 seconds
General
-
Target
979ca66179a9632e5308084fc289ce2b19c6b408cc5ec9a73196250637d9a4ca.dll
-
Size
764KB
-
MD5
936f6f1f61ae479a46f74c7c0fc99c20
-
SHA1
2a0b274b71ebe355767d535259fe536042741906
-
SHA256
979ca66179a9632e5308084fc289ce2b19c6b408cc5ec9a73196250637d9a4ca
-
SHA512
728e6033e90343074e08bf9b661c4ece7eeb51640df53e95aadf14f64566667c2e2b96ba19e5eb9691cc32c4f234a57cae366960cbe9d70e0be90b0da08e6fdd
-
SSDEEP
3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0i:jDgtfRQUHPw06MoV2nwTBlhm8K
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2264 wrote to memory of 3368 2264 rundll32.exe 83 PID 2264 wrote to memory of 3368 2264 rundll32.exe 83 PID 2264 wrote to memory of 3368 2264 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\979ca66179a9632e5308084fc289ce2b19c6b408cc5ec9a73196250637d9a4ca.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\979ca66179a9632e5308084fc289ce2b19c6b408cc5ec9a73196250637d9a4ca.dll,#12⤵PID:3368
-