Analysis
-
max time kernel
36s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
04/12/2022, 10:47
Static task
static1
Behavioral task
behavioral1
Sample
901e7fbc0260c34e746f7854eced86f443070cff1e50b2ff3681c5d69d2232e7.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
901e7fbc0260c34e746f7854eced86f443070cff1e50b2ff3681c5d69d2232e7.dll
Resource
win10v2004-20220812-en
General
-
Target
901e7fbc0260c34e746f7854eced86f443070cff1e50b2ff3681c5d69d2232e7.dll
-
Size
67KB
-
MD5
ef4adeeda19020dc4bf9d360b0f0a54a
-
SHA1
3cbe4a8c562e62aa949557912ba613fced740ec0
-
SHA256
901e7fbc0260c34e746f7854eced86f443070cff1e50b2ff3681c5d69d2232e7
-
SHA512
d14278a9093f20406dde0f1e184039279e6d9f66fb0f5b84d99be7cd230ce496b3de4cb2b488807e002eb6e6d4520af292a53eb5c6cda01c87007734a0c90fd8
-
SSDEEP
1536:p+l9qzWcgHubVZikHcqw8fdShGMMT5Elp0wnR/cHfupJy+sq:69qzlbO4nChGMk5EP0wC/upM+s
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1344 wrote to memory of 936 1344 rundll32.exe 28 PID 1344 wrote to memory of 936 1344 rundll32.exe 28 PID 1344 wrote to memory of 936 1344 rundll32.exe 28 PID 1344 wrote to memory of 936 1344 rundll32.exe 28 PID 1344 wrote to memory of 936 1344 rundll32.exe 28 PID 1344 wrote to memory of 936 1344 rundll32.exe 28 PID 1344 wrote to memory of 936 1344 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\901e7fbc0260c34e746f7854eced86f443070cff1e50b2ff3681c5d69d2232e7.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\901e7fbc0260c34e746f7854eced86f443070cff1e50b2ff3681c5d69d2232e7.dll,#12⤵PID:936
-