Analysis
-
max time kernel
90s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
21/11/2022, 15:36
Static task
static1
Behavioral task
behavioral1
Sample
e395c0a16fc2857694bc2276a5ce3e3078d95fadfd3087075585dac62f814ccb.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e395c0a16fc2857694bc2276a5ce3e3078d95fadfd3087075585dac62f814ccb.dll
Resource
win10v2004-20220901-en
General
-
Target
e395c0a16fc2857694bc2276a5ce3e3078d95fadfd3087075585dac62f814ccb.dll
-
Size
687KB
-
MD5
09cb8e1cb10ab7e60c8c58a7ad4d60e0
-
SHA1
b139ae75a102ee77fca214ecf9f6ebea88b90384
-
SHA256
e395c0a16fc2857694bc2276a5ce3e3078d95fadfd3087075585dac62f814ccb
-
SHA512
69cb39106a25a1743f931fee378462ea25d612cb292969cf5f8d412dc4cf9103fa43fc7b1ae1ffbe106b0748c4565d84a7361f796ea86419eea776012507e5ae
-
SSDEEP
3072:MyAb22wKbwa3ffR8aziy+T2zNlUCivYdZlSaA2861u2mxI7:MyjnKBfHTHpivYdZQaA2Dmx+
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1028 wrote to memory of 4804 1028 rundll32.exe 81 PID 1028 wrote to memory of 4804 1028 rundll32.exe 81 PID 1028 wrote to memory of 4804 1028 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e395c0a16fc2857694bc2276a5ce3e3078d95fadfd3087075585dac62f814ccb.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e395c0a16fc2857694bc2276a5ce3e3078d95fadfd3087075585dac62f814ccb.dll,#12⤵PID:4804
-