Analysis
-
max time kernel
154s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04-12-2022 00:00
Static task
static1
Behavioral task
behavioral1
Sample
1f5df9c71519088839d8d1914314a765b6b9d43836035ac1d1547361b0759eb5.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1f5df9c71519088839d8d1914314a765b6b9d43836035ac1d1547361b0759eb5.dll
Resource
win10v2004-20220812-en
General
-
Target
1f5df9c71519088839d8d1914314a765b6b9d43836035ac1d1547361b0759eb5.dll
-
Size
6KB
-
MD5
743391b316f6661ef7b10fe33e8b6410
-
SHA1
b798edeb4be64c9e7f6243bf34d8475cd9c9504c
-
SHA256
1f5df9c71519088839d8d1914314a765b6b9d43836035ac1d1547361b0759eb5
-
SHA512
fc64e6a148b6889a9a227d848f1b90316282cd1b30a81c9d036c30854a7dd0255f7fa2a709224d734124a5500b90191d0f6148d2241ea02f55ab928310776fb5
-
SSDEEP
96:juNrYuJ59oAwGQUI/TQahtCl8X3pSHnmnD7jMiB:juLJ/oAdQPQa2aeng7jMiB
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 908 wrote to memory of 4628 908 rundll32.exe 79 PID 908 wrote to memory of 4628 908 rundll32.exe 79 PID 908 wrote to memory of 4628 908 rundll32.exe 79
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1f5df9c71519088839d8d1914314a765b6b9d43836035ac1d1547361b0759eb5.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1f5df9c71519088839d8d1914314a765b6b9d43836035ac1d1547361b0759eb5.dll,#12⤵PID:4628
-