Analysis
-
max time kernel
8s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 12:38
Static task
static1
Behavioral task
behavioral1
Sample
fb38112f1062b8b0f3832d60b6ebf256945a1895f1826e3b6ea02fe49e65126a.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
fb38112f1062b8b0f3832d60b6ebf256945a1895f1826e3b6ea02fe49e65126a.dll
Resource
win10v2004-20220812-en
General
-
Target
fb38112f1062b8b0f3832d60b6ebf256945a1895f1826e3b6ea02fe49e65126a.dll
-
Size
296KB
-
MD5
94c3773128fed19e5271b945e577d176
-
SHA1
d9152e115f0d844dd0f81bb66f342706b8fc3c98
-
SHA256
fb38112f1062b8b0f3832d60b6ebf256945a1895f1826e3b6ea02fe49e65126a
-
SHA512
18cde4624e7f00c4be02223f9b4bf55f177578bab17ce937a6139c18d70a2b470a4a22cdc23e606a19fd0d92d4c9d269b0a629e3029295465cc099d6646a1edd
-
SSDEEP
3072:gLNikKwT1CQcOCbcLc1ep0zp7GEsWCd1fTe+X4oo4kfLeQTBfRoFixtkixB4K:gIjwRHPCH7RgRX4oo/fLeQTBJbDz
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 940 wrote to memory of 1788 940 rundll32.exe rundll32.exe PID 940 wrote to memory of 1788 940 rundll32.exe rundll32.exe PID 940 wrote to memory of 1788 940 rundll32.exe rundll32.exe PID 940 wrote to memory of 1788 940 rundll32.exe rundll32.exe PID 940 wrote to memory of 1788 940 rundll32.exe rundll32.exe PID 940 wrote to memory of 1788 940 rundll32.exe rundll32.exe PID 940 wrote to memory of 1788 940 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fb38112f1062b8b0f3832d60b6ebf256945a1895f1826e3b6ea02fe49e65126a.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fb38112f1062b8b0f3832d60b6ebf256945a1895f1826e3b6ea02fe49e65126a.dll,#12⤵PID:1788