Analysis
-
max time kernel
172s -
max time network
210s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2022, 11:18
Static task
static1
Behavioral task
behavioral1
Sample
f32068ce1d1f58a3d58660e77e67413bda2f6b1acdbfce3acc8e9f78467f8805.dll
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
f32068ce1d1f58a3d58660e77e67413bda2f6b1acdbfce3acc8e9f78467f8805.dll
Resource
win10v2004-20221111-en
windows10-2004-x64
General
-
Target
f32068ce1d1f58a3d58660e77e67413bda2f6b1acdbfce3acc8e9f78467f8805.dll
-
Size
84KB
-
MD5
4038a2e814790e34484f523b008911b9
-
SHA1
e57b435a205abbc955fe864f6a92186a500f86dc
-
SHA256
f32068ce1d1f58a3d58660e77e67413bda2f6b1acdbfce3acc8e9f78467f8805
-
SHA512
af2d12c957b45690e8c27a6e48c15d74c78ba12352adf2c9bc798fe4b017f09a9174c978db3cdce50398f57d8c17dea01aab2e1039cb46243fd247c35a3bd09e
-
SSDEEP
1536:Z3iD2Cmcvp8KhWwqi/q3Vls1ikoV47MwUJhuHvk:6HOyWpi/AVOBMwUJhuHc
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe 1324 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4244 wrote to memory of 1324 4244 rundll32.exe 82 PID 4244 wrote to memory of 1324 4244 rundll32.exe 82 PID 4244 wrote to memory of 1324 4244 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f32068ce1d1f58a3d58660e77e67413bda2f6b1acdbfce3acc8e9f78467f8805.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f32068ce1d1f58a3d58660e77e67413bda2f6b1acdbfce3acc8e9f78467f8805.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
PID:1324
-