Analysis
-
max time kernel
143s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2022, 12:01
Behavioral task
behavioral1
Sample
7ba49ca59c81cf30fc9455e0ce4050c202edb68ef6d1bf4df06e6ecb815f69c2.dll
Resource
win7-20221111-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
7ba49ca59c81cf30fc9455e0ce4050c202edb68ef6d1bf4df06e6ecb815f69c2.dll
Resource
win10v2004-20220812-en
2 signatures
150 seconds
General
-
Target
7ba49ca59c81cf30fc9455e0ce4050c202edb68ef6d1bf4df06e6ecb815f69c2.dll
-
Size
16KB
-
MD5
9b4ce259123f2826292c2ed47b642820
-
SHA1
34de2c137f0a19ea4db301964ff2070a61ac9b33
-
SHA256
7ba49ca59c81cf30fc9455e0ce4050c202edb68ef6d1bf4df06e6ecb815f69c2
-
SHA512
f579f0d8dacec66a875fa73c2dff5b1b049221982c631c2397d2c9ea78def5bba47fd83d0477d6c486586646834e417d20db1bee7372026a67f85fe74fd096e7
-
SSDEEP
384:Eg/9m7f9OzuPlMco4F5hAK8gAEOK4/vGzpSApwy:KfAzBco0TAK8dEVSvGzzuy
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1312-133-0x0000000010000000-0x000000001000F000-memory.dmp upx behavioral2/memory/1312-134-0x0000000010000000-0x000000001000F000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1192 wrote to memory of 1312 1192 rundll32.exe 76 PID 1192 wrote to memory of 1312 1192 rundll32.exe 76 PID 1192 wrote to memory of 1312 1192 rundll32.exe 76
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7ba49ca59c81cf30fc9455e0ce4050c202edb68ef6d1bf4df06e6ecb815f69c2.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7ba49ca59c81cf30fc9455e0ce4050c202edb68ef6d1bf4df06e6ecb815f69c2.dll,#12⤵PID:1312
-