Analysis
-
max time kernel
148s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01-12-2022 12:09
Static task
static1
Behavioral task
behavioral1
Sample
f6d71fb411ec625f6f0ccb09cfbe84cc87e8adf0d5aae415908ebe7c0ce99d55.dll
Resource
win7-20220812-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
f6d71fb411ec625f6f0ccb09cfbe84cc87e8adf0d5aae415908ebe7c0ce99d55.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
f6d71fb411ec625f6f0ccb09cfbe84cc87e8adf0d5aae415908ebe7c0ce99d55.dll
-
Size
284KB
-
MD5
ca2462a359021965578b9738cd188d5a
-
SHA1
433ae53606d820efa3cc223b5ad89a95ceed1db7
-
SHA256
f6d71fb411ec625f6f0ccb09cfbe84cc87e8adf0d5aae415908ebe7c0ce99d55
-
SHA512
cb4ebcf5167e102e4041c14fd9e17f348ff75f659d6ec00efbc54e7d162e65cf3be605a94b53410a554ee11e63d1e4a9b23fb8c739ee840ac5f3e14a767da21d
-
SSDEEP
6144:bHWQI4nDWgRAkPY5L9nyx+57JtbpBigPLobgPyeml:b5ZR3POFzmYv6
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2104 wrote to memory of 4440 2104 rundll32.exe 79 PID 2104 wrote to memory of 4440 2104 rundll32.exe 79 PID 2104 wrote to memory of 4440 2104 rundll32.exe 79
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f6d71fb411ec625f6f0ccb09cfbe84cc87e8adf0d5aae415908ebe7c0ce99d55.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f6d71fb411ec625f6f0ccb09cfbe84cc87e8adf0d5aae415908ebe7c0ce99d55.dll,#12⤵PID:4440
-