Analysis
-
max time kernel
44s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
01/11/2022, 10:36
Static task
static1
Behavioral task
behavioral1
Sample
5d11b009391ffab30cc00ae878a915c7bcbd2c486c2dd125a3d43fcd06e36102.dll
Resource
win7-20220901-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
5d11b009391ffab30cc00ae878a915c7bcbd2c486c2dd125a3d43fcd06e36102.dll
Resource
win10v2004-20220901-en
1 signatures
150 seconds
General
-
Target
5d11b009391ffab30cc00ae878a915c7bcbd2c486c2dd125a3d43fcd06e36102.dll
-
Size
23.5MB
-
MD5
0627fe1acad5caaf3fdffb410b7fda92
-
SHA1
c7e88b72b0967d54b87a891172561c66d98cbdb8
-
SHA256
5d11b009391ffab30cc00ae878a915c7bcbd2c486c2dd125a3d43fcd06e36102
-
SHA512
62a7c03b161c4705562f060660af145afc5b8362fb5674048787d53cf985b9ccc322ed238617cc84a3cc6699d4144b0851f0a15739dc648ea78bfbe2a1dcbf2d
-
SSDEEP
393216:VUm4pL3QIdcBXMfbrFlVQml8/bUhr39Cq:VURpL3S1MPbl6bijp
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1352 wrote to memory of 1528 1352 rundll32.exe 26 PID 1352 wrote to memory of 1528 1352 rundll32.exe 26 PID 1352 wrote to memory of 1528 1352 rundll32.exe 26 PID 1352 wrote to memory of 1528 1352 rundll32.exe 26 PID 1352 wrote to memory of 1528 1352 rundll32.exe 26 PID 1352 wrote to memory of 1528 1352 rundll32.exe 26 PID 1352 wrote to memory of 1528 1352 rundll32.exe 26
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5d11b009391ffab30cc00ae878a915c7bcbd2c486c2dd125a3d43fcd06e36102.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5d11b009391ffab30cc00ae878a915c7bcbd2c486c2dd125a3d43fcd06e36102.dll,#12⤵PID:1528
-