Analysis
-
max time kernel
42s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01-12-2022 17:39
Static task
static1
Behavioral task
behavioral1
Sample
caf939d3c0359797cf3c8eebbc1d1cb5e228749b56f5b43f189a40b9852bb34e.dll
Resource
win7-20220812-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
caf939d3c0359797cf3c8eebbc1d1cb5e228749b56f5b43f189a40b9852bb34e.dll
Resource
win10v2004-20221111-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
caf939d3c0359797cf3c8eebbc1d1cb5e228749b56f5b43f189a40b9852bb34e.dll
-
Size
72KB
-
MD5
a1e5519fe29512bd42c66eda25c8f486
-
SHA1
996bfa96378a9292167c0725c1d04d92d919241e
-
SHA256
caf939d3c0359797cf3c8eebbc1d1cb5e228749b56f5b43f189a40b9852bb34e
-
SHA512
c11737da11bbb285c93ac8fffd6fdb1f537eab818e3c5fa9064e40af15683320af2596759b4c07a10a3635612711996e41e19f6358e2a83c4f9c2d4c7688f01c
-
SSDEEP
1536:2UPMadZgQ24x/tCcgQFPvXGNRfWlAPClJO:2T8KQ2K/txrt2NNClJ
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1972 wrote to memory of 1032 1972 rundll32.exe 28 PID 1972 wrote to memory of 1032 1972 rundll32.exe 28 PID 1972 wrote to memory of 1032 1972 rundll32.exe 28 PID 1972 wrote to memory of 1032 1972 rundll32.exe 28 PID 1972 wrote to memory of 1032 1972 rundll32.exe 28 PID 1972 wrote to memory of 1032 1972 rundll32.exe 28 PID 1972 wrote to memory of 1032 1972 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\caf939d3c0359797cf3c8eebbc1d1cb5e228749b56f5b43f189a40b9852bb34e.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\caf939d3c0359797cf3c8eebbc1d1cb5e228749b56f5b43f189a40b9852bb34e.dll,#12⤵PID:1032
-