Analysis
-
max time kernel
43s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
01-12-2022 08:46
Static task
static1
Behavioral task
behavioral1
Sample
23ee69e2d29cea390ecdfb870d816ad8769a539476ed577f0a3c4377c04c0030.dll
Resource
win7-20220901-en
2 signatures
150 seconds
General
-
Target
23ee69e2d29cea390ecdfb870d816ad8769a539476ed577f0a3c4377c04c0030.dll
-
Size
281KB
-
MD5
ab55e07d29275006bf167b702060ff60
-
SHA1
a4136ac4043f4866fc418c766f191c08040cf3a8
-
SHA256
23ee69e2d29cea390ecdfb870d816ad8769a539476ed577f0a3c4377c04c0030
-
SHA512
ecb35b7248898e7e50847faffe6d508f4a61c173eb11023b3f5cb945f03a269d3bbf206fcefba296f0b570880d7b80a3ab324d2b19aea3fa59cadd499031134f
-
SSDEEP
3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0n:jDgtfRQUHPw06MoV2nwTBlhm8/
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1760 wrote to memory of 1252 1760 rundll32.exe 15 PID 1760 wrote to memory of 1252 1760 rundll32.exe 15 PID 1760 wrote to memory of 1252 1760 rundll32.exe 15 PID 1760 wrote to memory of 1252 1760 rundll32.exe 15 PID 1760 wrote to memory of 1252 1760 rundll32.exe 15 PID 1760 wrote to memory of 1252 1760 rundll32.exe 15 PID 1760 wrote to memory of 1252 1760 rundll32.exe 15
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\23ee69e2d29cea390ecdfb870d816ad8769a539476ed577f0a3c4377c04c0030.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\23ee69e2d29cea390ecdfb870d816ad8769a539476ed577f0a3c4377c04c0030.dll,#12⤵PID:1252
-