Analysis
-
max time kernel
140s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29/11/2022, 10:53
Static task
static1
Behavioral task
behavioral1
Sample
e3500d36c4386966d6d2c44d5548351efa018fb035847c9292cc55bc8c80a68c.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e3500d36c4386966d6d2c44d5548351efa018fb035847c9292cc55bc8c80a68c.dll
Resource
win10v2004-20220812-en
General
-
Target
e3500d36c4386966d6d2c44d5548351efa018fb035847c9292cc55bc8c80a68c.dll
-
Size
305KB
-
MD5
286a7107c09b0f8c0a98470f18658f59
-
SHA1
7d53536cd5af8a5ed75f1da8567218daf4744881
-
SHA256
e3500d36c4386966d6d2c44d5548351efa018fb035847c9292cc55bc8c80a68c
-
SHA512
99177b0888696837dad034a985dbfdaec70c9e829e9de4f9fd99c1ed93462d7d8be507fe5d7720e3425d259ce1afd433238c90426c36181dc0e2dfc88569384d
-
SSDEEP
6144:huBFnY78dgeBp6YMTE7q6Eru9DM5A2EMc5vwqrb:wHnO8dgeB6Th6bJM5mMc5Xb
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe 1700 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4556 wrote to memory of 1700 4556 rundll32.exe 79 PID 4556 wrote to memory of 1700 4556 rundll32.exe 79 PID 4556 wrote to memory of 1700 4556 rundll32.exe 79
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e3500d36c4386966d6d2c44d5548351efa018fb035847c9292cc55bc8c80a68c.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e3500d36c4386966d6d2c44d5548351efa018fb035847c9292cc55bc8c80a68c.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
PID:1700
-