Analysis
-
max time kernel
41s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
21/11/2022, 13:20
Behavioral task
behavioral1
Sample
ae6cfa14d2d1343db43fb997b5ba153b7954d0de00d6a0ff4b2dbbe9ce444b26.dll
Resource
win7-20220812-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
ae6cfa14d2d1343db43fb997b5ba153b7954d0de00d6a0ff4b2dbbe9ce444b26.dll
Resource
win10v2004-20220901-en
2 signatures
150 seconds
General
-
Target
ae6cfa14d2d1343db43fb997b5ba153b7954d0de00d6a0ff4b2dbbe9ce444b26.dll
-
Size
848KB
-
MD5
01a17cc00fdcc69afdce0ab234730fa0
-
SHA1
d1870cf0a5ff8c1ce09982ac51f806c5119337f7
-
SHA256
ae6cfa14d2d1343db43fb997b5ba153b7954d0de00d6a0ff4b2dbbe9ce444b26
-
SHA512
978434ef46f8af02b28be290522c6de1ded73eaf8c44d5f2329655995158266b81e8647c2be1b84e0b3fec30b4aaf01ba315633ed4d17e1e6ecac415da7e4d21
-
SSDEEP
24576:b+yw44EUzlQKI6Y9/hMY78DksUXOhHdPTv1F:b+yxY/I6+v784sUXsJhF
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1472-56-0x0000000000930000-0x0000000000AD4000-memory.dmp vmprotect behavioral1/memory/1472-57-0x0000000000930000-0x0000000000AD4000-memory.dmp vmprotect -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2020 wrote to memory of 1472 2020 rundll32.exe 26 PID 2020 wrote to memory of 1472 2020 rundll32.exe 26 PID 2020 wrote to memory of 1472 2020 rundll32.exe 26 PID 2020 wrote to memory of 1472 2020 rundll32.exe 26 PID 2020 wrote to memory of 1472 2020 rundll32.exe 26 PID 2020 wrote to memory of 1472 2020 rundll32.exe 26 PID 2020 wrote to memory of 1472 2020 rundll32.exe 26
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ae6cfa14d2d1343db43fb997b5ba153b7954d0de00d6a0ff4b2dbbe9ce444b26.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ae6cfa14d2d1343db43fb997b5ba153b7954d0de00d6a0ff4b2dbbe9ce444b26.dll,#12⤵PID:1472
-