Analysis
-
max time kernel
40s -
max time network
35s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 11:12
Static task
static1
Behavioral task
behavioral1
Sample
f465f5d831773f60c066363eb9857affce9b5778ffc866ee27f699b7aaec33a5.dll
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral2
Sample
f465f5d831773f60c066363eb9857affce9b5778ffc866ee27f699b7aaec33a5.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
f465f5d831773f60c066363eb9857affce9b5778ffc866ee27f699b7aaec33a5.dll
-
Size
704KB
-
MD5
ce13c884231e3f2af5198798ec505f22
-
SHA1
03f62944d4857c9c41c28e24749b43ffdfdd4c4b
-
SHA256
f465f5d831773f60c066363eb9857affce9b5778ffc866ee27f699b7aaec33a5
-
SHA512
0483a523e58be5be34feba9077e9dbc1707f845229abb11636f83b42a521d8f1de273f63a453f0ccb0b82fc14b154f6e20b07ce857b2e47c5b61a97fff7d00d8
-
SSDEEP
12288:tVQpdF9GSJmoP8fFArbr9b+kamM5lNwSJUtuGKYNTef:tVQpv9uoOYbr9KvNwSJUtbTef
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe 888 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1308 wrote to memory of 888 1308 rundll32.exe 28 PID 1308 wrote to memory of 888 1308 rundll32.exe 28 PID 1308 wrote to memory of 888 1308 rundll32.exe 28 PID 1308 wrote to memory of 888 1308 rundll32.exe 28 PID 1308 wrote to memory of 888 1308 rundll32.exe 28 PID 1308 wrote to memory of 888 1308 rundll32.exe 28 PID 1308 wrote to memory of 888 1308 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f465f5d831773f60c066363eb9857affce9b5778ffc866ee27f699b7aaec33a5.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f465f5d831773f60c066363eb9857affce9b5778ffc866ee27f699b7aaec33a5.dll,#12⤵
- Suspicious use of SetWindowsHookEx
PID:888
-