Analysis
-
max time kernel
201s -
max time network
205s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29/11/2022, 17:08
Static task
static1
Behavioral task
behavioral1
Sample
3600fd1047a498c73d106e2207f85161dd2b4eb09e5738ea2ca1d663ea8649f9.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3600fd1047a498c73d106e2207f85161dd2b4eb09e5738ea2ca1d663ea8649f9.dll
Resource
win10v2004-20220812-en
General
-
Target
3600fd1047a498c73d106e2207f85161dd2b4eb09e5738ea2ca1d663ea8649f9.dll
-
Size
18KB
-
MD5
945ca5f84e2b9f631758e8f8a76f5d20
-
SHA1
ace6087961d664c9e08a2d89b66273d39b9c3903
-
SHA256
3600fd1047a498c73d106e2207f85161dd2b4eb09e5738ea2ca1d663ea8649f9
-
SHA512
49ec13ac7b907b010802c138ec939eb08e1e9db37f8027dea52615305a8e17269e6c5237898c7ebdbd43b44140dbe55aa3255f7454cd0292cf41cdbf9022a6cd
-
SSDEEP
384:96CiGC+GoC37M6F0yWqYkD68PXR+zCru60vivma:91iO27MUWXkvXR++ruXv+p
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4092 wrote to memory of 4952 4092 rundll32.exe 78 PID 4092 wrote to memory of 4952 4092 rundll32.exe 78 PID 4092 wrote to memory of 4952 4092 rundll32.exe 78
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3600fd1047a498c73d106e2207f85161dd2b4eb09e5738ea2ca1d663ea8649f9.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3600fd1047a498c73d106e2207f85161dd2b4eb09e5738ea2ca1d663ea8649f9.dll,#12⤵PID:4952
-