Analysis
-
max time kernel
10s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01/12/2022, 14:06
Static task
static1
Behavioral task
behavioral1
Sample
9e71b46b50749aab6bad78d6f74c91f7020bfb4c5cd5737d5c7d35ba4958988d.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9e71b46b50749aab6bad78d6f74c91f7020bfb4c5cd5737d5c7d35ba4958988d.dll
Resource
win10v2004-20220812-en
General
-
Target
9e71b46b50749aab6bad78d6f74c91f7020bfb4c5cd5737d5c7d35ba4958988d.dll
-
Size
24KB
-
MD5
7cc8963aeb7fceb7dee5349936133cee
-
SHA1
14dd0bf92bb484adc0aff79c84c8d7a46033de7e
-
SHA256
9e71b46b50749aab6bad78d6f74c91f7020bfb4c5cd5737d5c7d35ba4958988d
-
SHA512
77b6774686c3dadb1b90638829ad47309ebb35250ce7c2df1eaaa725af79d413a4064de93c7ba1da151a9e15ab73e6d1a774f2e170201ecdf47c917db2b31445
-
SSDEEP
96:9z//FIJcThaSuDKIrI9K+U5woa9W+3Px/24J4eve5S1och8e:B//5fuNk9M5I91MSH8e
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1600 wrote to memory of 1296 1600 rundll32.exe 27 PID 1600 wrote to memory of 1296 1600 rundll32.exe 27 PID 1600 wrote to memory of 1296 1600 rundll32.exe 27 PID 1600 wrote to memory of 1296 1600 rundll32.exe 27 PID 1600 wrote to memory of 1296 1600 rundll32.exe 27 PID 1600 wrote to memory of 1296 1600 rundll32.exe 27 PID 1600 wrote to memory of 1296 1600 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9e71b46b50749aab6bad78d6f74c91f7020bfb4c5cd5737d5c7d35ba4958988d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9e71b46b50749aab6bad78d6f74c91f7020bfb4c5cd5737d5c7d35ba4958988d.dll,#12⤵PID:1296
-