Analysis
-
max time kernel
91s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
16-12-2022 19:54
Static task
static1
Behavioral task
behavioral1
Sample
5d4d1b094c527ae6ec5cdf6895725358955da16a6f027509071b6795343eed7c.dll
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral2
Sample
5d4d1b094c527ae6ec5cdf6895725358955da16a6f027509071b6795343eed7c.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
5d4d1b094c527ae6ec5cdf6895725358955da16a6f027509071b6795343eed7c.dll
-
Size
3.8MB
-
MD5
dec57a9660e546b917a4514425289e9d
-
SHA1
759362876a553d20175e3829e990ae2047a80ff5
-
SHA256
5d4d1b094c527ae6ec5cdf6895725358955da16a6f027509071b6795343eed7c
-
SHA512
ca9224dab2698b56680130ea34e84f05a73d342a54ad8bf34c1de78fd4b551f602bd81335ad9be3e25350e5672867291eb08c9bd2929bffa1f8295c8ba9c5ad5
-
SSDEEP
49152:EXe8ATCJjH6mOoRmqI28OXHfiChBk3MhIseqw1zYnwWP2yGvq:aGTCJjHsoRvI2RXHfrhBk38IRqw10l
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 4 4952 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4952 rundll32.exe 4952 rundll32.exe -
Suspicious use of SetWindowsHookEx 52 IoCs
pid Process 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3016 wrote to memory of 4952 3016 rundll32.exe 79 PID 3016 wrote to memory of 4952 3016 rundll32.exe 79 PID 3016 wrote to memory of 4952 3016 rundll32.exe 79
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5d4d1b094c527ae6ec5cdf6895725358955da16a6f027509071b6795343eed7c.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5d4d1b094c527ae6ec5cdf6895725358955da16a6f027509071b6795343eed7c.dll,#12⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4952
-