Analysis
-
max time kernel
110s -
max time network
114s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11-11-2022 06:39
Static task
static1
Behavioral task
behavioral1
Sample
7950s116.6l7.dll
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
7950s116.6l7.dll
Resource
win10v2004-20220901-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
7950s116.6l7.dll
-
Size
91KB
-
MD5
21a15705090603c66d22ac12a4e84077
-
SHA1
d7d05e8f899ec33df75f15e7692951bfc319cdc2
-
SHA256
1507f5917861161d4745b3662f3c6d146ba92ce7eec4e36033f6e321cb6c5533
-
SHA512
6138b3985c98b56dd8bb36c8c0eff3821eaedfb39fba2576449c3d78e6994339f4df50e684ddc9edca664cd7c05445f61e2d0ec21c979b032fad42971b7ff9ad
-
SSDEEP
1536:LxkrFbIFlwpdlAD12GWC+uxOdtstfXT8Oxl8sNOjW4ZKqbxZKl9BROlaN7Ey:LxkpIFlwSD12GX3VtpxlNQWobnKHqlaq
Score
10/10
Malware Config
Extracted
Family
icedid
Campaign
1292139634
C2
oiurkastarting.com
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 2 1408 rundll32.exe 4 1408 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 1408 rundll32.exe 1408 rundll32.exe