Analysis
-
max time kernel
169s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
01-12-2022 08:46
Static task
static1
Behavioral task
behavioral1
Sample
52879f479b5546b60279ab57af340ab6958c1be8e29322f63053739f904575e9.dll
Resource
win7-20221111-en
2 signatures
150 seconds
General
-
Target
52879f479b5546b60279ab57af340ab6958c1be8e29322f63053739f904575e9.dll
-
Size
350KB
-
MD5
7bba422886739593c2fd2848d9f0e4b8
-
SHA1
3c1ec51d54836f59630cea5db3c7c4f79e140eac
-
SHA256
52879f479b5546b60279ab57af340ab6958c1be8e29322f63053739f904575e9
-
SHA512
8695db885b615e59c1705accfaf7e091248b28eb15cd108fbe297da46e0c9e3ef1ca447a6e2c5d220a53ef3f005165b2f195e23101a3bb8bf9f87ac6b1ce9038
-
SSDEEP
3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0m:jDgtfRQUHPw06MoV2nwTBlhm8e
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2100 wrote to memory of 1272 2100 rundll32.exe 82 PID 2100 wrote to memory of 1272 2100 rundll32.exe 82 PID 2100 wrote to memory of 1272 2100 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\52879f479b5546b60279ab57af340ab6958c1be8e29322f63053739f904575e9.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\52879f479b5546b60279ab57af340ab6958c1be8e29322f63053739f904575e9.dll,#12⤵PID:1272
-