Analysis
-
max time kernel
201s -
max time network
224s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
04/12/2022, 09:30
Static task
static1
Behavioral task
behavioral1
Sample
f21dd86efde0d66de1972cc6f32c624a1f62d3e4e20ed2212524e184096f5429.dll
Resource
win7-20221111-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
f21dd86efde0d66de1972cc6f32c624a1f62d3e4e20ed2212524e184096f5429.dll
Resource
win10v2004-20221111-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
f21dd86efde0d66de1972cc6f32c624a1f62d3e4e20ed2212524e184096f5429.dll
-
Size
498KB
-
MD5
b35470413c718a614161a8df6e3d34bd
-
SHA1
2b3431d305ebf4d4dae7ea7697ba499433187ff6
-
SHA256
f21dd86efde0d66de1972cc6f32c624a1f62d3e4e20ed2212524e184096f5429
-
SHA512
778b312b5b90db64fc2e3c4b8be0ef89e72c6f365f030e5238dc140a0b85fc2b54868ed258f67bd8b44fc96e87c363bb939bdc41b910241461ef95fc64682e21
-
SSDEEP
12288:Rp//oQGL2rc9z5Ud4O3Mmtlw3mCZ1GKP32fN:RlQZi684gbk2CZcd
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2276 wrote to memory of 3500 2276 rundll32.exe 81 PID 2276 wrote to memory of 3500 2276 rundll32.exe 81 PID 2276 wrote to memory of 3500 2276 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f21dd86efde0d66de1972cc6f32c624a1f62d3e4e20ed2212524e184096f5429.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f21dd86efde0d66de1972cc6f32c624a1f62d3e4e20ed2212524e184096f5429.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
PID:3500
-