Analysis
-
max time kernel
203s -
max time network
210s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 05:42
Behavioral task
behavioral1
Sample
8cf640ab8fcac90766716494f858547aeeb43efb100fcb2cd165dd30370ccaec.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8cf640ab8fcac90766716494f858547aeeb43efb100fcb2cd165dd30370ccaec.dll
Resource
win10v2004-20221111-en
General
-
Target
8cf640ab8fcac90766716494f858547aeeb43efb100fcb2cd165dd30370ccaec.dll
-
Size
152KB
-
MD5
1542892f83c5767339235bba6e44c410
-
SHA1
b27594c3e538454b9fb6fb28a68f89e94c00e6f4
-
SHA256
8cf640ab8fcac90766716494f858547aeeb43efb100fcb2cd165dd30370ccaec
-
SHA512
3abb27f32db86d60040868e135b2df7a2daee8ddeebdb75a6c64cd5fcb5dc670eb04e1838b2dd7e654bf4ef908d93a323d6d4acac08521c343306c8f82a16b18
-
SSDEEP
3072:Pb8m+CtsQMuSfwKKgd/yKG8T5CHx0aLU3ELPm5jbPWg1vZ1ZYey+71ykY6zOzi:I3CEfwK68lCHBe1ug1vZ13Eaazi
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/1840-133-0x0000000010000000-0x0000000010067000-memory.dmp vmprotect behavioral2/memory/1840-136-0x0000000010000000-0x0000000010067000-memory.dmp vmprotect -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4528 wrote to memory of 1840 4528 rundll32.exe rundll32.exe PID 4528 wrote to memory of 1840 4528 rundll32.exe rundll32.exe PID 4528 wrote to memory of 1840 4528 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8cf640ab8fcac90766716494f858547aeeb43efb100fcb2cd165dd30370ccaec.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8cf640ab8fcac90766716494f858547aeeb43efb100fcb2cd165dd30370ccaec.dll,#12⤵