Analysis
-
max time kernel
91s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2022, 04:41
Behavioral task
behavioral1
Sample
cd738be22aab6dc5aeb2c01cfb8bec7f541c0c9d34446fdb3f8e941bc6c5e3e1.dll
Resource
win7-20221111-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
cd738be22aab6dc5aeb2c01cfb8bec7f541c0c9d34446fdb3f8e941bc6c5e3e1.dll
Resource
win10v2004-20220812-en
2 signatures
150 seconds
General
-
Target
cd738be22aab6dc5aeb2c01cfb8bec7f541c0c9d34446fdb3f8e941bc6c5e3e1.dll
-
Size
60KB
-
MD5
6ea7c837b1e5b45253608af8dd562d70
-
SHA1
6d3286d09625ffebe3db3bfdb90c1dcd3b2aeb16
-
SHA256
cd738be22aab6dc5aeb2c01cfb8bec7f541c0c9d34446fdb3f8e941bc6c5e3e1
-
SHA512
3b379ca489429aaa389a0cf8193e25763b76aea0402fb30dba339a3edfa74a3fe6cc6427845fd418c9bc7c948d3307495ca74bba6a66ea307a7ca4ae5c6c12c4
-
SSDEEP
1536:94t7achiUJe2r2voD2GXI85HYDO4ItRltreqMgEy:+7ac3e2Kv6R5HYiljlleqMgn
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1420-133-0x0000000010000000-0x000000001000D000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 928 wrote to memory of 1420 928 rundll32.exe 79 PID 928 wrote to memory of 1420 928 rundll32.exe 79 PID 928 wrote to memory of 1420 928 rundll32.exe 79
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cd738be22aab6dc5aeb2c01cfb8bec7f541c0c9d34446fdb3f8e941bc6c5e3e1.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cd738be22aab6dc5aeb2c01cfb8bec7f541c0c9d34446fdb3f8e941bc6c5e3e1.dll,#12⤵PID:1420
-