Analysis
-
max time kernel
13s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 13:07
Static task
static1
Behavioral task
behavioral1
Sample
c9d17aa2f2fe1dd62f3772766237dbc3ba79e0ca8698a2d8d6e62baf1d1edeac.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c9d17aa2f2fe1dd62f3772766237dbc3ba79e0ca8698a2d8d6e62baf1d1edeac.dll
Resource
win10v2004-20220901-en
General
-
Target
c9d17aa2f2fe1dd62f3772766237dbc3ba79e0ca8698a2d8d6e62baf1d1edeac.dll
-
Size
125KB
-
MD5
76477bbd905de7b6bd572acc0f39e50a
-
SHA1
e8a7482dc7806013a769c8cba56afe44e83f45f3
-
SHA256
c9d17aa2f2fe1dd62f3772766237dbc3ba79e0ca8698a2d8d6e62baf1d1edeac
-
SHA512
fa4aa37101a57ac394b6dafdd545cfd94701112419086ed3ae7c9f46cb806289ee14f57fbd9abf2fa55a07fc7ff8904a930e9d966938d934c58304f9f26dd6f8
-
SSDEEP
1536:J2bKKlmWNCuRXGWNnCrv9mL1wfKjczsUMK0SftF9t6F3dzjQV0XFiUar:kbj0Wcu1dNCrVE6fhoSFQpNVFnar
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 944 wrote to memory of 520 944 rundll32.exe rundll32.exe PID 944 wrote to memory of 520 944 rundll32.exe rundll32.exe PID 944 wrote to memory of 520 944 rundll32.exe rundll32.exe PID 944 wrote to memory of 520 944 rundll32.exe rundll32.exe PID 944 wrote to memory of 520 944 rundll32.exe rundll32.exe PID 944 wrote to memory of 520 944 rundll32.exe rundll32.exe PID 944 wrote to memory of 520 944 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c9d17aa2f2fe1dd62f3772766237dbc3ba79e0ca8698a2d8d6e62baf1d1edeac.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c9d17aa2f2fe1dd62f3772766237dbc3ba79e0ca8698a2d8d6e62baf1d1edeac.dll,#12⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/520-54-0x0000000000000000-mapping.dmp
-
memory/520-55-0x0000000075351000-0x0000000075353000-memory.dmpFilesize
8KB
-
memory/520-56-0x0000000010000000-0x000000001002A000-memory.dmpFilesize
168KB
-
memory/520-57-0x0000000000120000-0x0000000000133000-memory.dmpFilesize
76KB
-
memory/520-59-0x0000000010000000-0x0000000010012000-memory.dmpFilesize
72KB
-
memory/520-62-0x0000000000120000-0x0000000000133000-memory.dmpFilesize
76KB
-
memory/520-63-0x0000000000120000-0x0000000000133000-memory.dmpFilesize
76KB