Analysis
-
max time kernel
92s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2022 02:05
Static task
static1
Behavioral task
behavioral1
Sample
73eba15dc8ebe4f5e2ff5b38b03f5813.dll
Resource
win7-20220901-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
73eba15dc8ebe4f5e2ff5b38b03f5813.dll
Resource
win10v2004-20220901-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
73eba15dc8ebe4f5e2ff5b38b03f5813.dll
-
Size
223KB
-
MD5
73eba15dc8ebe4f5e2ff5b38b03f5813
-
SHA1
9da5119da4d6f80215e5831a13579fdc639a836b
-
SHA256
ef67cbf884b084103d61ec0bcfbe4e68f57e8c952da34051079d82870d3a60fe
-
SHA512
0da7bd0a5405b2be9e993ea87ccaef7d8c81e621ccb4cd8a37aca4c1bee173ae277e7f9d46bce58a74e6e29055999ae6ae53138a0e7cb326f397a52a222a6fba
-
SSDEEP
3072:y/pW3srl+mxFh0Iea2MHep5Cdr8iY2hsK/6LsLF+3H:yBN+kFh0IH2M+p5Cyf2h9/ve
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1724 wrote to memory of 1664 1724 rundll32.exe 81 PID 1724 wrote to memory of 1664 1724 rundll32.exe 81 PID 1724 wrote to memory of 1664 1724 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\73eba15dc8ebe4f5e2ff5b38b03f5813.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\73eba15dc8ebe4f5e2ff5b38b03f5813.dll,#12⤵PID:1664
-