Analysis
-
max time kernel
47s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
29-11-2022 12:56
Static task
static1
Behavioral task
behavioral1
Sample
261d4346c8135c7ae9ea2556281fa2846cc86138326d3e767ad12f18e32f72a2.dll
Resource
win7-20220901-en
windows7-x64
2 signatures
150 seconds
General
-
Target
261d4346c8135c7ae9ea2556281fa2846cc86138326d3e767ad12f18e32f72a2.dll
-
Size
322KB
-
MD5
79a9e642f531469c20d14d3445fc7040
-
SHA1
e0b2e7e0b2ebb40826f293c4534e9c778ce29ed1
-
SHA256
261d4346c8135c7ae9ea2556281fa2846cc86138326d3e767ad12f18e32f72a2
-
SHA512
15f8bbfdca32d83ad5b4e4b53afc73d8ee619574b01fd04187e44fc5335ac235e8ba088256f6a39712e7bb4839192e7f746316ae1e4d28db48fec95529d5ed7c
-
SSDEEP
3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0+:jDgtfRQUHPw06MoV2nwTBlhm82
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 960 wrote to memory of 628 960 rundll32.exe 27 PID 960 wrote to memory of 628 960 rundll32.exe 27 PID 960 wrote to memory of 628 960 rundll32.exe 27 PID 960 wrote to memory of 628 960 rundll32.exe 27 PID 960 wrote to memory of 628 960 rundll32.exe 27 PID 960 wrote to memory of 628 960 rundll32.exe 27 PID 960 wrote to memory of 628 960 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\261d4346c8135c7ae9ea2556281fa2846cc86138326d3e767ad12f18e32f72a2.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\261d4346c8135c7ae9ea2556281fa2846cc86138326d3e767ad12f18e32f72a2.dll,#12⤵PID:628
-