Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2022 04:51
Static task
static1
Behavioral task
behavioral1
Sample
8d1f7b8b1493974ed50b619aa8d0f04c088652772a034eef34ca2ac32d5adc1e.dll
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral2
Sample
8d1f7b8b1493974ed50b619aa8d0f04c088652772a034eef34ca2ac32d5adc1e.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
8d1f7b8b1493974ed50b619aa8d0f04c088652772a034eef34ca2ac32d5adc1e.dll
-
Size
64KB
-
MD5
32cf3b4c18026ad64044a0227debdb4a
-
SHA1
6fda41e17fffa525f4ffe874468ee13d94e75c76
-
SHA256
8d1f7b8b1493974ed50b619aa8d0f04c088652772a034eef34ca2ac32d5adc1e
-
SHA512
db1ff6a52fa70f1ad0ee06e910c3d1e53e80db44960b15c865241aa2d1e7bfd724cfa66cb01b6389381359bf8a1973d22b020c381fde5f8dd50bc48bb83fbe9b
-
SSDEEP
768:JUCK7zpR9yaktKTBEHtxiXGLvaXouTSfbN5HwQmvge7tmUROeEJ9y59oUS28:MXknWGa4uT2Z5HwkIEJ09ob28
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 4356 rundll32.exe 4356 rundll32.exe 4356 rundll32.exe 4356 rundll32.exe 4356 rundll32.exe 4356 rundll32.exe 4356 rundll32.exe 4356 rundll32.exe 4356 rundll32.exe 4356 rundll32.exe 4356 rundll32.exe 4356 rundll32.exe 4356 rundll32.exe 4356 rundll32.exe 4356 rundll32.exe 4356 rundll32.exe 4356 rundll32.exe 4356 rundll32.exe 4356 rundll32.exe 4356 rundll32.exe 4356 rundll32.exe 4356 rundll32.exe 4356 rundll32.exe 4356 rundll32.exe 4356 rundll32.exe 4356 rundll32.exe 4356 rundll32.exe 4356 rundll32.exe 4356 rundll32.exe 4356 rundll32.exe 4356 rundll32.exe 4356 rundll32.exe 4356 rundll32.exe 4356 rundll32.exe 4356 rundll32.exe 4356 rundll32.exe 4356 rundll32.exe 4356 rundll32.exe 4356 rundll32.exe 4356 rundll32.exe 4356 rundll32.exe 4356 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2352 wrote to memory of 4356 2352 rundll32.exe 62 PID 2352 wrote to memory of 4356 2352 rundll32.exe 62 PID 2352 wrote to memory of 4356 2352 rundll32.exe 62
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8d1f7b8b1493974ed50b619aa8d0f04c088652772a034eef34ca2ac32d5adc1e.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8d1f7b8b1493974ed50b619aa8d0f04c088652772a034eef34ca2ac32d5adc1e.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
PID:4356
-