Analysis
-
max time kernel
187s -
max time network
206s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
02/12/2022, 22:57
Static task
static1
Behavioral task
behavioral1
Sample
47a35f99803bdc8d65836a09ac64e9c9f25e972a3c02e47c01134e72d75fc7f8.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
47a35f99803bdc8d65836a09ac64e9c9f25e972a3c02e47c01134e72d75fc7f8.dll
Resource
win10v2004-20221111-en
General
-
Target
47a35f99803bdc8d65836a09ac64e9c9f25e972a3c02e47c01134e72d75fc7f8.dll
-
Size
236KB
-
MD5
afe0b2ada17dd7499175201529671b00
-
SHA1
e9180a0fc07ea9f5ace7503fa8291e779a60f1c0
-
SHA256
47a35f99803bdc8d65836a09ac64e9c9f25e972a3c02e47c01134e72d75fc7f8
-
SHA512
f7001f984aad669b5bf760c6e2e021e16d457a257e30824f2af6c47dd153adc3ebe1399a273d6e29883d24924565eedc494623a7976405f2639d8d2bb7cc4c23
-
SSDEEP
6144:eneA7poLiVy+w+X0u4zT1IwwrYvFGZ1FtxJUopxvn:enZ7poLsaw4z1GZ1HvUoz
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3928 wrote to memory of 1364 3928 rundll32.exe 83 PID 3928 wrote to memory of 1364 3928 rundll32.exe 83 PID 3928 wrote to memory of 1364 3928 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\47a35f99803bdc8d65836a09ac64e9c9f25e972a3c02e47c01134e72d75fc7f8.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\47a35f99803bdc8d65836a09ac64e9c9f25e972a3c02e47c01134e72d75fc7f8.dll,#12⤵PID:1364
-