Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04-12-2022 09:16
Static task
static1
Behavioral task
behavioral1
Sample
c463f8158bd2c2221e0fd5d67d419fcf68ece78ab498cc9e734c7012e3a6eca3.dll
Resource
win7-20220812-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
c463f8158bd2c2221e0fd5d67d419fcf68ece78ab498cc9e734c7012e3a6eca3.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
c463f8158bd2c2221e0fd5d67d419fcf68ece78ab498cc9e734c7012e3a6eca3.dll
-
Size
3KB
-
MD5
77da706c6ab3b7cfdcc03acf79214730
-
SHA1
5b5a082bb71e6e5e24204d7df597146a83a9b39f
-
SHA256
c463f8158bd2c2221e0fd5d67d419fcf68ece78ab498cc9e734c7012e3a6eca3
-
SHA512
5e350ab71aab563741b5feb98eb65252e8a61e0220e6ff3591f96211951980a4911ed70a74568ef385c37b2902a5e6592899cd3ece7e5f2bec5dc7a94ca56150
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4756 wrote to memory of 2008 4756 rundll32.exe 80 PID 4756 wrote to memory of 2008 4756 rundll32.exe 80 PID 4756 wrote to memory of 2008 4756 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c463f8158bd2c2221e0fd5d67d419fcf68ece78ab498cc9e734c7012e3a6eca3.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c463f8158bd2c2221e0fd5d67d419fcf68ece78ab498cc9e734c7012e3a6eca3.dll,#12⤵PID:2008
-