Analysis
-
max time kernel
31s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 03:23
Behavioral task
behavioral1
Sample
Documento.dll
Resource
win7-20220812-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Documento.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
Documento.dll
-
Size
627KB
-
MD5
67a94068ccdf4124369c8c4f795dd188
-
SHA1
878aa8246ae0084d1e37e810c83deee3f2371c55
-
SHA256
645fd5823b27e4d8c592888bf07056878ffa3568f2959aded51d3d95be71913e
-
SHA512
d60df03d17324450ed2caa012fa0bb1f3f3efdb47ffd91fca954effaaf64fa812d2155f5db8c1f0f1fd3d04e4578b2576e8eceeae5abe46a62ee7bfbd4e58329
-
SSDEEP
12288:ukZaLNryXCSWKXPl/m25EMICK5YJc+/Qps0ABzRD0xCmzJv6eZrtY4Y3Tz:HZaUXCSWKfl/m25TK/pulDsv6CrtY4Y3
Score
8/10
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1948-56-0x0000000000940000-0x0000000000A9D000-memory.dmp vmprotect behavioral1/memory/1948-57-0x0000000000940000-0x0000000000A9D000-memory.dmp vmprotect behavioral1/memory/1948-59-0x0000000000940000-0x0000000000A9D000-memory.dmp vmprotect -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1952 wrote to memory of 1948 1952 rundll32.exe rundll32.exe PID 1952 wrote to memory of 1948 1952 rundll32.exe rundll32.exe PID 1952 wrote to memory of 1948 1952 rundll32.exe rundll32.exe PID 1952 wrote to memory of 1948 1952 rundll32.exe rundll32.exe PID 1952 wrote to memory of 1948 1952 rundll32.exe rundll32.exe PID 1952 wrote to memory of 1948 1952 rundll32.exe rundll32.exe PID 1952 wrote to memory of 1948 1952 rundll32.exe rundll32.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1948-54-0x0000000000000000-mapping.dmp
-
memory/1948-55-0x00000000762F1000-0x00000000762F3000-memory.dmpFilesize
8KB
-
memory/1948-56-0x0000000000940000-0x0000000000A9D000-memory.dmpFilesize
1.4MB
-
memory/1948-57-0x0000000000940000-0x0000000000A9D000-memory.dmpFilesize
1.4MB
-
memory/1948-59-0x0000000000940000-0x0000000000A9D000-memory.dmpFilesize
1.4MB