Analysis
-
max time kernel
171s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2022, 10:45
Static task
static1
Behavioral task
behavioral1
Sample
fd39eca22e85e8e57ddd9ed17a94b876c128b24da63d555e5ac2dc6ea7e6ed9b.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
fd39eca22e85e8e57ddd9ed17a94b876c128b24da63d555e5ac2dc6ea7e6ed9b.dll
Resource
win10v2004-20221111-en
General
-
Target
fd39eca22e85e8e57ddd9ed17a94b876c128b24da63d555e5ac2dc6ea7e6ed9b.dll
-
Size
34KB
-
MD5
7d675d53cd7191cde6e9853099ccf0e0
-
SHA1
d5569776fcb8ab34e034a83137d272cbb476106b
-
SHA256
fd39eca22e85e8e57ddd9ed17a94b876c128b24da63d555e5ac2dc6ea7e6ed9b
-
SHA512
ac982ed519e51cdcfaa875faee41ba4dc6316b5d4ba9ced78ff15776b23a045bb779d6794b63dc692a98a8d7405ff6f0911b33a2a562b6bbec671ac6f5773678
-
SSDEEP
768:/7mRDL0cgngbMzSJOQc7S/DftqqhnP0RROGWN:zmRD7gHzS0d7S/1pMRROGk
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3564 wrote to memory of 4504 3564 rundll32.exe 84 PID 3564 wrote to memory of 4504 3564 rundll32.exe 84 PID 3564 wrote to memory of 4504 3564 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fd39eca22e85e8e57ddd9ed17a94b876c128b24da63d555e5ac2dc6ea7e6ed9b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fd39eca22e85e8e57ddd9ed17a94b876c128b24da63d555e5ac2dc6ea7e6ed9b.dll,#12⤵PID:4504
-