42156a7626a184e4edb12b9fffe5a31bcae103a8d210138175272077b93dfab8

Analysis

max time kernel
125s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12-11-2022 09:43

Target

HEUR-Trojan-Banker.Win32.Danabot.gen-42156a76.dll
Size

1.2MB
MD5

1465a7ff75a2e8636db1be0fac7d7e12
SHA1

58fb4a6f02e5639a266ccc39fb71c1d6a687305b
SHA256

42156a7626a184e4edb12b9fffe5a31bcae103a8d210138175272077b93dfab8
SHA512

e48f87098dfbf24c166fb9a09302a659de91cdd4294c7e7507c51707f0bd69e982ec079f6ddd0b56336a71d6a9696d2cfe0aeeae50d76a45a4dcd9f1157ba839
SSDEEP

24576:8b1nfBwzVWsEqGhfgl01nezvEcm86CMvihkH5eMOT/vyG:4uEZOI2842zYpT/v

Score

8^/10

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

4 3348 rundll32.exe

flow	pid	process
4	3348	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2268 wrote to memory of 3348	2268	rundll32.exe	rundll32.exe
PID 2268 wrote to memory of 3348	2268	rundll32.exe	rundll32.exe
PID 2268 wrote to memory of 3348	2268	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Banker.Win32.Danabot.gen-42156a76.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2268

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Banker.Win32.Danabot.gen-42156a76.dll,#1
2⤵
- Blocklisted process makes network request
PID:3348