Analysis
-
max time kernel
43s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 21:30
Static task
static1
Behavioral task
behavioral1
Sample
aa1928276ef766e811794b9286a2af8733bc0a6749f365068140fdd1bc6629a9.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
aa1928276ef766e811794b9286a2af8733bc0a6749f365068140fdd1bc6629a9.dll
Resource
win10v2004-20220812-en
General
-
Target
aa1928276ef766e811794b9286a2af8733bc0a6749f365068140fdd1bc6629a9.dll
-
Size
45KB
-
MD5
265a3c1a2a3cebb840230932ad749f56
-
SHA1
619a8754d1d2941cfb8ab3903e4c60f4a218216f
-
SHA256
aa1928276ef766e811794b9286a2af8733bc0a6749f365068140fdd1bc6629a9
-
SHA512
79765d10592a3106c1ac6e77e59ae4ca5643e417f72110a2a6233505c7feb774005f4da006324f86b383bdcbd7635af99086e80eec10baf714e29c22dc9d137b
-
SSDEEP
768:/C/96BnUVHmgOMtitTjxyNq5ewMwkjw5I9tGEADjMl6t:K/9oUC4WTQNqNfkjw2G4l
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1980 wrote to memory of 1972 1980 rundll32.exe rundll32.exe PID 1980 wrote to memory of 1972 1980 rundll32.exe rundll32.exe PID 1980 wrote to memory of 1972 1980 rundll32.exe rundll32.exe PID 1980 wrote to memory of 1972 1980 rundll32.exe rundll32.exe PID 1980 wrote to memory of 1972 1980 rundll32.exe rundll32.exe PID 1980 wrote to memory of 1972 1980 rundll32.exe rundll32.exe PID 1980 wrote to memory of 1972 1980 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\aa1928276ef766e811794b9286a2af8733bc0a6749f365068140fdd1bc6629a9.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\aa1928276ef766e811794b9286a2af8733bc0a6749f365068140fdd1bc6629a9.dll,#12⤵