Analysis
-
max time kernel
183s -
max time network
194s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 20:18
Static task
static1
Behavioral task
behavioral1
Sample
6f328ed468b00948e669aa680edf91fabd1ee63274ac59422c0a30e6a648a78b.dll
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral2
Sample
6f328ed468b00948e669aa680edf91fabd1ee63274ac59422c0a30e6a648a78b.dll
Resource
win10v2004-20221111-en
windows10-2004-x64
General
-
Target
6f328ed468b00948e669aa680edf91fabd1ee63274ac59422c0a30e6a648a78b.dll
-
Size
47KB
-
MD5
46123c688f5062cd3d54ca5a3c41d8a0
-
SHA1
9fd699c948014d419ad3a3cb9c38b6c955fec89f
-
SHA256
6f328ed468b00948e669aa680edf91fabd1ee63274ac59422c0a30e6a648a78b
-
SHA512
40e0e1f5acb846ebec05113362cde37e9bba2f3cd31e4cd0b67a0a061803c64a06036ba71ed92132ce0f0eff62273c01e0f352c262310c151cf8a730ace250f8
-
SSDEEP
768:OXMl2iz3EdxQGFSxGkU10TDjHfZuw/bbKtEUk49FyAVX09IPXOoP:OXMkiz3EdxVFwGJ10TnHEAbbKtEUkiys
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe 3176 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2624 wrote to memory of 3176 2624 rundll32.exe 81 PID 2624 wrote to memory of 3176 2624 rundll32.exe 81 PID 2624 wrote to memory of 3176 2624 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6f328ed468b00948e669aa680edf91fabd1ee63274ac59422c0a30e6a648a78b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6f328ed468b00948e669aa680edf91fabd1ee63274ac59422c0a30e6a648a78b.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
PID:3176
-