Analysis
-
max time kernel
143s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2022, 23:10
Static task
static1
Behavioral task
behavioral1
Sample
52664e788ec9ce6555a9979cd6092099499396a7ff3af99bde03bae7f7014573.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
52664e788ec9ce6555a9979cd6092099499396a7ff3af99bde03bae7f7014573.dll
Resource
win10v2004-20220812-en
General
-
Target
52664e788ec9ce6555a9979cd6092099499396a7ff3af99bde03bae7f7014573.dll
-
Size
6KB
-
MD5
7f2f9e13bec52fc8af9fe9f454052390
-
SHA1
6126ab911b52377c709c2206320a5c0a40821162
-
SHA256
52664e788ec9ce6555a9979cd6092099499396a7ff3af99bde03bae7f7014573
-
SHA512
e196e0cf8b6b59e6db1d220b9c25b1fe4bd9d0ad07b88f2610c2c05b360014cacd8bc86452f0eac9871920baf77a040fc2ad2af539652d383c35f2e6a84b4843
-
SSDEEP
96:ng92nrwQ0eqnOxk6nTsuxD2R5RL9TAF7h/j7kC69CXut4/KAahxwm2fjMk:/neeRtn7l25tuhHmAX1KAwxwlf
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2220 wrote to memory of 4248 2220 rundll32.exe 79 PID 2220 wrote to memory of 4248 2220 rundll32.exe 79 PID 2220 wrote to memory of 4248 2220 rundll32.exe 79
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\52664e788ec9ce6555a9979cd6092099499396a7ff3af99bde03bae7f7014573.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\52664e788ec9ce6555a9979cd6092099499396a7ff3af99bde03bae7f7014573.dll,#12⤵PID:4248
-