Analysis
-
max time kernel
146s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2022 23:52
Static task
static1
Behavioral task
behavioral1
Sample
a66b221f537a4c7489954085e89a3e6a140ea32aaf5d191d86cca56b89d96d5e.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a66b221f537a4c7489954085e89a3e6a140ea32aaf5d191d86cca56b89d96d5e.dll
Resource
win10v2004-20220812-en
General
-
Target
a66b221f537a4c7489954085e89a3e6a140ea32aaf5d191d86cca56b89d96d5e.dll
-
Size
137KB
-
MD5
00d0a934e71ef5457330ee514c4b7550
-
SHA1
4cb31c85d0a87e043d79974f83983aa979000f0c
-
SHA256
a66b221f537a4c7489954085e89a3e6a140ea32aaf5d191d86cca56b89d96d5e
-
SHA512
4d751419e3915f6f432fa8416ed7cdd075f86995fc3f91c406d22c9d05f0123fbd68f9999075779e6e5526bc0a88145abc78f05a8f5dc0ae7f699a0d4babde99
-
SSDEEP
3072:S8wA0TMD5Dqg0yN1nvAANSw8ltWoihGCyMOLySWst+fXxv0ILi:S8w6D4Kotup0LWI+fQ
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 532 wrote to memory of 1344 532 rundll32.exe 80 PID 532 wrote to memory of 1344 532 rundll32.exe 80 PID 532 wrote to memory of 1344 532 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a66b221f537a4c7489954085e89a3e6a140ea32aaf5d191d86cca56b89d96d5e.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a66b221f537a4c7489954085e89a3e6a140ea32aaf5d191d86cca56b89d96d5e.dll,#12⤵PID:1344
-