Analysis
-
max time kernel
187s -
max time network
193s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
02/12/2022, 01:36
Static task
static1
Behavioral task
behavioral1
Sample
5973f3273a342de07776dcba5788e4280b5bd09c0ab1e29637daa68ce71f26d8.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5973f3273a342de07776dcba5788e4280b5bd09c0ab1e29637daa68ce71f26d8.dll
Resource
win10v2004-20221111-en
General
-
Target
5973f3273a342de07776dcba5788e4280b5bd09c0ab1e29637daa68ce71f26d8.dll
-
Size
5KB
-
MD5
9056466345023b9a50349fdd979610f0
-
SHA1
cbe933a648f1c92abf0d8684b61e4df8a534ad84
-
SHA256
5973f3273a342de07776dcba5788e4280b5bd09c0ab1e29637daa68ce71f26d8
-
SHA512
3ffac6cc7a130def05e475b7ab3c9d6d0a7a526c1bc9233ea68fe764c343bf8c70c0c1a42e061a740a8fb5cb95ff6288ef7661aeeaa737d9de88a19afaca924b
-
SSDEEP
96:nEY2RrF1eqwi4jkVcY/A+4NT84NtXPN+RU7B:EHRh1eppjkVcY/A+4NT84Nt/N++7B
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1256 wrote to memory of 3800 1256 rundll32.exe 84 PID 1256 wrote to memory of 3800 1256 rundll32.exe 84 PID 1256 wrote to memory of 3800 1256 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5973f3273a342de07776dcba5788e4280b5bd09c0ab1e29637daa68ce71f26d8.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5973f3273a342de07776dcba5788e4280b5bd09c0ab1e29637daa68ce71f26d8.dll,#12⤵PID:3800
-