Analysis
-
max time kernel
40s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19/11/2022, 04:50
Static task
static1
Behavioral task
behavioral1
Sample
eff78d4e8c3750f7c16d00417cf601f8e9efb1c258373b4139860fd37be883d9.dll
Resource
win7-20220812-en
1 signatures
150 seconds
General
-
Target
eff78d4e8c3750f7c16d00417cf601f8e9efb1c258373b4139860fd37be883d9.dll
-
Size
72KB
-
MD5
2585c0fe09d2f03a82dae7a18e76b9af
-
SHA1
63f4bff1c9fa6ee0f493b3db7f8b93f0cd09e22c
-
SHA256
eff78d4e8c3750f7c16d00417cf601f8e9efb1c258373b4139860fd37be883d9
-
SHA512
33a7b10e5f2d1fa0d41be38085c33500b7a3a6f9a079fc11a4225d72406afd51839cbb60dd52c2e7e8c230490f11b243b8e001b757e3900c0e96561c39f34398
-
SSDEEP
1536:QstOC7PazOFn058YaUxwjYi+GhOambg5pRDi6gcW:NNIxwjhubyDiMW
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1504 wrote to memory of 1460 1504 rundll32.exe 26 PID 1504 wrote to memory of 1460 1504 rundll32.exe 26 PID 1504 wrote to memory of 1460 1504 rundll32.exe 26 PID 1504 wrote to memory of 1460 1504 rundll32.exe 26 PID 1504 wrote to memory of 1460 1504 rundll32.exe 26 PID 1504 wrote to memory of 1460 1504 rundll32.exe 26 PID 1504 wrote to memory of 1460 1504 rundll32.exe 26
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eff78d4e8c3750f7c16d00417cf601f8e9efb1c258373b4139860fd37be883d9.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eff78d4e8c3750f7c16d00417cf601f8e9efb1c258373b4139860fd37be883d9.dll,#12⤵PID:1460
-