Analysis
-
max time kernel
42s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
07-11-2022 10:53
Static task
static1
Behavioral task
behavioral1
Sample
6a82646c6bc160160649740ed76cae9cbfd6011a81378e27b01969fbea315865.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
6a82646c6bc160160649740ed76cae9cbfd6011a81378e27b01969fbea315865.dll
Resource
win10v2004-20220812-en
General
-
Target
6a82646c6bc160160649740ed76cae9cbfd6011a81378e27b01969fbea315865.dll
-
Size
1.5MB
-
MD5
3b99846b60209561d49b4b9a2f00d7ca
-
SHA1
aa944052076fec5bf563311047f8eb9cfbe5e0a1
-
SHA256
6a82646c6bc160160649740ed76cae9cbfd6011a81378e27b01969fbea315865
-
SHA512
ba48caf6ea561a671f9a607e854d7f444b6a2145acff965f10743f7f140a257ed8c4e4e1da29a67413b6ce517c29f5544042136450b6a581fcbacd6a4a7f24c1
-
SSDEEP
24576:gM1siLftC5D7INZXY0YwmZ26F1B9SQI/UDvBtfQfnPClebXWCEFGMQBl2:p2iTtCP/Se6nP4EEFqBl2
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1632 wrote to memory of 1260 1632 rundll32.exe 28 PID 1632 wrote to memory of 1260 1632 rundll32.exe 28 PID 1632 wrote to memory of 1260 1632 rundll32.exe 28 PID 1632 wrote to memory of 1260 1632 rundll32.exe 28 PID 1632 wrote to memory of 1260 1632 rundll32.exe 28 PID 1632 wrote to memory of 1260 1632 rundll32.exe 28 PID 1632 wrote to memory of 1260 1632 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6a82646c6bc160160649740ed76cae9cbfd6011a81378e27b01969fbea315865.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6a82646c6bc160160649740ed76cae9cbfd6011a81378e27b01969fbea315865.dll,#12⤵PID:1260
-