Analysis
-
max time kernel
42s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
20-12-2022 14:41
Static task
static1
Behavioral task
behavioral1
Sample
8f535c330c5d52d8fd07413e5b10584c955344f1d2247fefb63c96c4cce172a8.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8f535c330c5d52d8fd07413e5b10584c955344f1d2247fefb63c96c4cce172a8.dll
Resource
win10v2004-20220812-en
General
-
Target
8f535c330c5d52d8fd07413e5b10584c955344f1d2247fefb63c96c4cce172a8.dll
-
Size
224KB
-
MD5
014f6dd6fc2f68d922694f0adc7d8287
-
SHA1
fe7655c0da89444ace114089daef59d46522bef8
-
SHA256
8f535c330c5d52d8fd07413e5b10584c955344f1d2247fefb63c96c4cce172a8
-
SHA512
8ee65b2254d49dd9683941f05b90acd69c17b52234b0fd216a4542aabc502bdff546df51893d839f18540462ab69fb0824139c516edfdb1c8845f3a66f06f4c2
-
SSDEEP
3072:JRL5bTtBekENQ/1fZPGfc0x9hE3/hoT8xkjf1bDGwf2BD6:JnTqaPvoT8Mf1bD3f2BD6
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1972 wrote to memory of 1032 1972 rundll32.exe 28 PID 1972 wrote to memory of 1032 1972 rundll32.exe 28 PID 1972 wrote to memory of 1032 1972 rundll32.exe 28 PID 1972 wrote to memory of 1032 1972 rundll32.exe 28 PID 1972 wrote to memory of 1032 1972 rundll32.exe 28 PID 1972 wrote to memory of 1032 1972 rundll32.exe 28 PID 1972 wrote to memory of 1032 1972 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8f535c330c5d52d8fd07413e5b10584c955344f1d2247fefb63c96c4cce172a8.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8f535c330c5d52d8fd07413e5b10584c955344f1d2247fefb63c96c4cce172a8.dll,#12⤵PID:1032
-