Analysis
-
max time kernel
45s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29/11/2022, 15:07
Static task
static1
Behavioral task
behavioral1
Sample
b42b3936948ba9a7b2da8a8f6ee2dbcc11f68367e5ac76b866ccf5a8d863c22b.dll
Resource
win7-20220812-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
b42b3936948ba9a7b2da8a8f6ee2dbcc11f68367e5ac76b866ccf5a8d863c22b.dll
Resource
win10v2004-20221111-en
1 signatures
150 seconds
General
-
Target
b42b3936948ba9a7b2da8a8f6ee2dbcc11f68367e5ac76b866ccf5a8d863c22b.dll
-
Size
3KB
-
MD5
b90c38b60f2ccf9e20499e212e351634
-
SHA1
892e0489941fdb1198b2ada9fe6d17ca41e38e39
-
SHA256
b42b3936948ba9a7b2da8a8f6ee2dbcc11f68367e5ac76b866ccf5a8d863c22b
-
SHA512
ccdebf8976c3d39aaa09b2988259ae956480c70bd9ca19486b82e60fc75ce8c06193033e6e184ef9d8886cf04f99e817e96037e89c44261c65e8db29cfb1dcb6
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1980 wrote to memory of 940 1980 rundll32.exe 28 PID 1980 wrote to memory of 940 1980 rundll32.exe 28 PID 1980 wrote to memory of 940 1980 rundll32.exe 28 PID 1980 wrote to memory of 940 1980 rundll32.exe 28 PID 1980 wrote to memory of 940 1980 rundll32.exe 28 PID 1980 wrote to memory of 940 1980 rundll32.exe 28 PID 1980 wrote to memory of 940 1980 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b42b3936948ba9a7b2da8a8f6ee2dbcc11f68367e5ac76b866ccf5a8d863c22b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b42b3936948ba9a7b2da8a8f6ee2dbcc11f68367e5ac76b866ccf5a8d863c22b.dll,#12⤵PID:940
-