Analysis
-
max time kernel
181s -
max time network
226s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 19:45
Behavioral task
behavioral1
Sample
9400e3c799a34f5aadfd67847e57e8fadc5651f696c104bd34fb938e891a56d4.dll
Resource
win7-20220812-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
9400e3c799a34f5aadfd67847e57e8fadc5651f696c104bd34fb938e891a56d4.dll
Resource
win10v2004-20221111-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
9400e3c799a34f5aadfd67847e57e8fadc5651f696c104bd34fb938e891a56d4.dll
-
Size
10KB
-
MD5
61264f4f54dd61fac30f152c096b0a28
-
SHA1
6c1219fe4bc16a22e69995f08eaab4b1461ae925
-
SHA256
9400e3c799a34f5aadfd67847e57e8fadc5651f696c104bd34fb938e891a56d4
-
SHA512
9b08e5a0e2b41f85a8bb99e10be154f72b31f0f070c5b0e149caaaa8ec5c78633237652ff93e0dc961934d4c68e02768fc56324e9e89b763f74dc46a37364b0e
-
SSDEEP
192:ljMnPLqkkQq3hab0LBdFpjg04hoDajg6luF5khNGafB:6qkvqRYW9pjmhoehNGo
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4936 wrote to memory of 3884 4936 rundll32.exe rundll32.exe PID 4936 wrote to memory of 3884 4936 rundll32.exe rundll32.exe PID 4936 wrote to memory of 3884 4936 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9400e3c799a34f5aadfd67847e57e8fadc5651f696c104bd34fb938e891a56d4.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9400e3c799a34f5aadfd67847e57e8fadc5651f696c104bd34fb938e891a56d4.dll,#12⤵PID:3884