Analysis
-
max time kernel
55s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
01-12-2022 20:47
Static task
static1
Behavioral task
behavioral1
Sample
974a390b316596545931d7d17625919eb13a3752ed36362c62eb779944d78700.dll
Resource
win7-20221111-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
974a390b316596545931d7d17625919eb13a3752ed36362c62eb779944d78700.dll
Resource
win10v2004-20221111-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
974a390b316596545931d7d17625919eb13a3752ed36362c62eb779944d78700.dll
-
Size
57KB
-
MD5
6e8a05addf66de4beed7a44973e232ec
-
SHA1
c158abbbf0e84807e0c258ca396082fb6f55cb19
-
SHA256
974a390b316596545931d7d17625919eb13a3752ed36362c62eb779944d78700
-
SHA512
d743f1e9b99f336ca794f6c82cbe6e9f1057917f761396e5b458e8b4ea01a5969d64b27844d3b0b503527c6e754b8137c9e1c8e36513b51d008d7c49de0523e0
-
SSDEEP
1536:rNIKDv4YU6EMyDcqiZZZNihyISFIR6/JP+3CT:Sqv4YU6ErtGNEKIpCT
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1972 wrote to memory of 280 1972 rundll32.exe 28 PID 1972 wrote to memory of 280 1972 rundll32.exe 28 PID 1972 wrote to memory of 280 1972 rundll32.exe 28 PID 1972 wrote to memory of 280 1972 rundll32.exe 28 PID 1972 wrote to memory of 280 1972 rundll32.exe 28 PID 1972 wrote to memory of 280 1972 rundll32.exe 28 PID 1972 wrote to memory of 280 1972 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\974a390b316596545931d7d17625919eb13a3752ed36362c62eb779944d78700.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\974a390b316596545931d7d17625919eb13a3752ed36362c62eb779944d78700.dll,#12⤵PID:280
-