Analysis
-
max time kernel
190s -
max time network
193s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
01-12-2022 18:12
Static task
static1
Behavioral task
behavioral1
Sample
c3204b219a1e2fea5a3e542dcf4c02791702fbadc35733d7872644a14e48eb0e.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
c3204b219a1e2fea5a3e542dcf4c02791702fbadc35733d7872644a14e48eb0e.dll
Resource
win10v2004-20221111-en
General
-
Target
c3204b219a1e2fea5a3e542dcf4c02791702fbadc35733d7872644a14e48eb0e.dll
-
Size
108KB
-
MD5
c1028b6a2ad191e33bd6605e80615772
-
SHA1
acaec4ab5b938e2492a93c9ced66e72ef8f034b9
-
SHA256
c3204b219a1e2fea5a3e542dcf4c02791702fbadc35733d7872644a14e48eb0e
-
SHA512
f7621103c3b20baae05edea9de5bdb8d368748bd800610075373d930b43d0132a6bf962ebcac69094fd539214f0e70c75c2256510585d128b3e877869389b7ce
-
SSDEEP
1536:VK/MFocGogybG+60Q+uEEpBl2+Q1BvEnSpEqN2PpdGixX3jHOlalN05m:VUKocH6MQ+uZ0R15//arZalalNcm
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2656 wrote to memory of 2628 2656 rundll32.exe 81 PID 2656 wrote to memory of 2628 2656 rundll32.exe 81 PID 2656 wrote to memory of 2628 2656 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c3204b219a1e2fea5a3e542dcf4c02791702fbadc35733d7872644a14e48eb0e.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c3204b219a1e2fea5a3e542dcf4c02791702fbadc35733d7872644a14e48eb0e.dll,#12⤵PID:2628
-