Analysis
-
max time kernel
60s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
01/12/2022, 05:24
Static task
static1
Behavioral task
behavioral1
Sample
2cbc756d4a5d913753f82a807e0a7c1cc35ce899783fc9fd43d92ac2912f5a9a.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
2cbc756d4a5d913753f82a807e0a7c1cc35ce899783fc9fd43d92ac2912f5a9a.dll
Resource
win10v2004-20221111-en
General
-
Target
2cbc756d4a5d913753f82a807e0a7c1cc35ce899783fc9fd43d92ac2912f5a9a.dll
-
Size
4KB
-
MD5
978584e0c12968a5be68983bf5f9d8e0
-
SHA1
e0a782d2865488ea3294ef64d268f5e8d6427fd9
-
SHA256
2cbc756d4a5d913753f82a807e0a7c1cc35ce899783fc9fd43d92ac2912f5a9a
-
SHA512
eb57e4468403a474e8c2edf331a41d9567efcd2e439f6a09543317e1a6a677318c7aa34ce406ae86e03096c1df785f1591f6492e60d2fee5909e68a6df4cd151
-
SSDEEP
48:iMHGv8j2IcW89NYEArhWHR0MiiIsiI6lXVkqlcH2SuiS6o+mm9XoWebdiU:PmkiIz8UZrQ0MhI/ITqly9XrRU
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1108 wrote to memory of 2012 1108 rundll32.exe 28 PID 1108 wrote to memory of 2012 1108 rundll32.exe 28 PID 1108 wrote to memory of 2012 1108 rundll32.exe 28 PID 1108 wrote to memory of 2012 1108 rundll32.exe 28 PID 1108 wrote to memory of 2012 1108 rundll32.exe 28 PID 1108 wrote to memory of 2012 1108 rundll32.exe 28 PID 1108 wrote to memory of 2012 1108 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2cbc756d4a5d913753f82a807e0a7c1cc35ce899783fc9fd43d92ac2912f5a9a.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2cbc756d4a5d913753f82a807e0a7c1cc35ce899783fc9fd43d92ac2912f5a9a.dll,#12⤵PID:2012
-