Analysis
-
max time kernel
42s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02-12-2022 02:44
Static task
static1
Behavioral task
behavioral1
Sample
b4afa6e5ddfcb3dd04cab7161b5f3947e602d65fdfb450fabf3f49c373b9bf0c.dll
Resource
win7-20220812-en
2 signatures
150 seconds
General
-
Target
b4afa6e5ddfcb3dd04cab7161b5f3947e602d65fdfb450fabf3f49c373b9bf0c.dll
-
Size
300KB
-
MD5
a6df570744da7f07b4ab6b0e8559e271
-
SHA1
3cd78c9f101a507f12fceb2bc2b44a11e573a6f9
-
SHA256
b4afa6e5ddfcb3dd04cab7161b5f3947e602d65fdfb450fabf3f49c373b9bf0c
-
SHA512
7230cdee5d223a261402f1f4f22f0bee89e75e590b7cd06f374ed58c8ec96e1c824d47a722bb97d6c195f517736ed9f4d1bd33dc01fb807932559a63340845e7
-
SSDEEP
3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q08:jDgtfRQUHPw06MoV2nwTBlhm8E
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1048 wrote to memory of 540 1048 rundll32.exe 27 PID 1048 wrote to memory of 540 1048 rundll32.exe 27 PID 1048 wrote to memory of 540 1048 rundll32.exe 27 PID 1048 wrote to memory of 540 1048 rundll32.exe 27 PID 1048 wrote to memory of 540 1048 rundll32.exe 27 PID 1048 wrote to memory of 540 1048 rundll32.exe 27 PID 1048 wrote to memory of 540 1048 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b4afa6e5ddfcb3dd04cab7161b5f3947e602d65fdfb450fabf3f49c373b9bf0c.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b4afa6e5ddfcb3dd04cab7161b5f3947e602d65fdfb450fabf3f49c373b9bf0c.dll,#12⤵PID:540
-