Analysis
-
max time kernel
148s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06-11-2022 04:09
Static task
static1
Behavioral task
behavioral1
Sample
c12650fa1a6e90696c1be191da73ebf34b27a325dc9db014216afa4ddb56cab7.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c12650fa1a6e90696c1be191da73ebf34b27a325dc9db014216afa4ddb56cab7.dll
Resource
win10v2004-20220812-en
General
-
Target
c12650fa1a6e90696c1be191da73ebf34b27a325dc9db014216afa4ddb56cab7.dll
-
Size
34KB
-
MD5
08dcd98e3aaa9e34a9dccf9973aaad70
-
SHA1
a7fc1d3f5888f662648db832ebc4acf9b1f3e040
-
SHA256
c12650fa1a6e90696c1be191da73ebf34b27a325dc9db014216afa4ddb56cab7
-
SHA512
ace472adb670f8c65f8e6cc1391551ebcf3280f911b3d4d0a1d605ab4f24e7d1117fc0d3174373a673c471ecb52c4bde6ebfec87c23f273639bfb85d75ba1b41
-
SSDEEP
768:sPkbmHTTPBjupvnNr77OpcdPuOJph32R7RMgi:qkbcTVjuf77OpobpJ2R7R1i
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1268 wrote to memory of 5068 1268 rundll32.exe 81 PID 1268 wrote to memory of 5068 1268 rundll32.exe 81 PID 1268 wrote to memory of 5068 1268 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c12650fa1a6e90696c1be191da73ebf34b27a325dc9db014216afa4ddb56cab7.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c12650fa1a6e90696c1be191da73ebf34b27a325dc9db014216afa4ddb56cab7.dll,#12⤵PID:5068
-