Analysis
-
max time kernel
142s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04/12/2022, 00:27
Behavioral task
behavioral1
Sample
c6636503d90275b3ca2ab26d7dc41dcaca3ebcd35bb7cc0932321074990840ca.dll
Resource
win7-20220901-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
c6636503d90275b3ca2ab26d7dc41dcaca3ebcd35bb7cc0932321074990840ca.dll
Resource
win10v2004-20220812-en
1 signatures
150 seconds
General
-
Target
c6636503d90275b3ca2ab26d7dc41dcaca3ebcd35bb7cc0932321074990840ca.dll
-
Size
76KB
-
MD5
f15b7f589b7bfab1cc86f94b186b9db0
-
SHA1
a91b39437072fe1ae8315cbc9ecf2c8efced86f0
-
SHA256
c6636503d90275b3ca2ab26d7dc41dcaca3ebcd35bb7cc0932321074990840ca
-
SHA512
c4d1e2d6faa8cb4c69958118614b42ae9e40da7f0ea731d4d849010f7199f42bf084326866613267aaaf29f0d6e126e84f594be81a1bd1e240e8d4b8b702fbe0
-
SSDEEP
1536:Bm1NGJVGvpPBblTbbZzH0JyjYlG1n077uzuggCgFkC9IGIlf:kX0VapPBhH6YjYlG1UIugrAkC9G
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4820 wrote to memory of 1692 4820 rundll32.exe 80 PID 4820 wrote to memory of 1692 4820 rundll32.exe 80 PID 4820 wrote to memory of 1692 4820 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c6636503d90275b3ca2ab26d7dc41dcaca3ebcd35bb7cc0932321074990840ca.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c6636503d90275b3ca2ab26d7dc41dcaca3ebcd35bb7cc0932321074990840ca.dll,#12⤵PID:1692
-