Analysis
-
max time kernel
112s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
01-12-2022 13:22
Static task
static1
Behavioral task
behavioral1
Sample
1f325101d135587fe78c121b2e65537638ba81a7f099665a33bc58a1c74af1a2.dll
Resource
win7-20220812-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
1f325101d135587fe78c121b2e65537638ba81a7f099665a33bc58a1c74af1a2.dll
Resource
win10v2004-20220901-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
1f325101d135587fe78c121b2e65537638ba81a7f099665a33bc58a1c74af1a2.dll
-
Size
4KB
-
MD5
eeb36820a72b1db2b8856444d8d5b86b
-
SHA1
7bcbf4adae3e79beafe3ea43a4e94df360425e08
-
SHA256
1f325101d135587fe78c121b2e65537638ba81a7f099665a33bc58a1c74af1a2
-
SHA512
a8694113d7afc125bb716b28a43a7afd98a1333af28815b97111711c684153606b733f66e18e752beae2670dc9f6c6bc982e2075e15151a82944219e60b62230
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2672 wrote to memory of 1724 2672 rundll32.exe 82 PID 2672 wrote to memory of 1724 2672 rundll32.exe 82 PID 2672 wrote to memory of 1724 2672 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1f325101d135587fe78c121b2e65537638ba81a7f099665a33bc58a1c74af1a2.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1f325101d135587fe78c121b2e65537638ba81a7f099665a33bc58a1c74af1a2.dll,#12⤵PID:1724
-