Analysis
-
max time kernel
202s -
max time network
208s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 16:52
Static task
static1
Behavioral task
behavioral1
Sample
91408dc36d93d5814601dd546b84623404398186323b3e8306cbf10fc1caffb7.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
91408dc36d93d5814601dd546b84623404398186323b3e8306cbf10fc1caffb7.dll
Resource
win10v2004-20221111-en
General
-
Target
91408dc36d93d5814601dd546b84623404398186323b3e8306cbf10fc1caffb7.dll
-
Size
9KB
-
MD5
35584bfc00f80ef4814b25bd9056de42
-
SHA1
8b590f026c780695be94a0d7cc08105cfdada3e2
-
SHA256
91408dc36d93d5814601dd546b84623404398186323b3e8306cbf10fc1caffb7
-
SHA512
a3f1ad3c36587709cf6a6676db533f14b280efd6d2b0508babbddb6f89469ff9d39109786131e34cea62b862d858908ea5e129b15c65bd729264399a9b2ae18a
-
SSDEEP
192:Dw8dHabRDEgtHyl0NSypWak6HVdW3yWak8QjdW3w96:ddHad/N20IypWak8dWiWak8EdW9
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3192 wrote to memory of 4444 3192 rundll32.exe rundll32.exe PID 3192 wrote to memory of 4444 3192 rundll32.exe rundll32.exe PID 3192 wrote to memory of 4444 3192 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\91408dc36d93d5814601dd546b84623404398186323b3e8306cbf10fc1caffb7.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\91408dc36d93d5814601dd546b84623404398186323b3e8306cbf10fc1caffb7.dll,#12⤵PID:4444