Analysis
-
max time kernel
167s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01-12-2022 08:46
Static task
static1
Behavioral task
behavioral1
Sample
23ee69e2d29cea390ecdfb870d816ad8769a539476ed577f0a3c4377c04c0030.dll
Resource
win7-20220901-en
2 signatures
150 seconds
General
-
Target
23ee69e2d29cea390ecdfb870d816ad8769a539476ed577f0a3c4377c04c0030.dll
-
Size
281KB
-
MD5
ab55e07d29275006bf167b702060ff60
-
SHA1
a4136ac4043f4866fc418c766f191c08040cf3a8
-
SHA256
23ee69e2d29cea390ecdfb870d816ad8769a539476ed577f0a3c4377c04c0030
-
SHA512
ecb35b7248898e7e50847faffe6d508f4a61c173eb11023b3f5cb945f03a269d3bbf206fcefba296f0b570880d7b80a3ab324d2b19aea3fa59cadd499031134f
-
SSDEEP
3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0n:jDgtfRQUHPw06MoV2nwTBlhm8/
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4556 wrote to memory of 4720 4556 rundll32.exe 79 PID 4556 wrote to memory of 4720 4556 rundll32.exe 79 PID 4556 wrote to memory of 4720 4556 rundll32.exe 79
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\23ee69e2d29cea390ecdfb870d816ad8769a539476ed577f0a3c4377c04c0030.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\23ee69e2d29cea390ecdfb870d816ad8769a539476ed577f0a3c4377c04c0030.dll,#12⤵PID:4720
-