Analysis
-
max time kernel
91s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2022, 12:11
Static task
static1
Behavioral task
behavioral1
Sample
9448f1d1a581a4e4c5830e8d4f4c3a6db572eac190ec63178c9020fde2cf4f49.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9448f1d1a581a4e4c5830e8d4f4c3a6db572eac190ec63178c9020fde2cf4f49.dll
Resource
win10v2004-20220812-en
General
-
Target
9448f1d1a581a4e4c5830e8d4f4c3a6db572eac190ec63178c9020fde2cf4f49.dll
-
Size
100KB
-
MD5
6206aa4f1f068eb07f2178898c39af42
-
SHA1
e7e3d373f12050693502ea18f9bacc490c8af2ea
-
SHA256
9448f1d1a581a4e4c5830e8d4f4c3a6db572eac190ec63178c9020fde2cf4f49
-
SHA512
849dfd132cc8ecc167af2c1437ad80650e0949766c6eae6c9e2d4c6f024d542048c06fc110c52344e3f1d9ff7187c959d25345baed4ee23fe9cfbabd4fc75b21
-
SSDEEP
1536:fDpVWfsTqgpbD1pR0Fkvbs70zXqOJG9uXptp+6tIgaKxFISWedsXo4FYESM9:7/Rpf1p8kv5D1bJt7tISWrBmS
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4072 wrote to memory of 2004 4072 rundll32.exe 80 PID 4072 wrote to memory of 2004 4072 rundll32.exe 80 PID 4072 wrote to memory of 2004 4072 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9448f1d1a581a4e4c5830e8d4f4c3a6db572eac190ec63178c9020fde2cf4f49.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9448f1d1a581a4e4c5830e8d4f4c3a6db572eac190ec63178c9020fde2cf4f49.dll,#12⤵PID:2004
-