Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25/12/2022, 22:37
Behavioral task
behavioral1
Sample
1668-57-0x0000000000160000-0x0000000000182000-memory.dll
Resource
win7-20221111-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
1668-57-0x0000000000160000-0x0000000000182000-memory.dll
Resource
win10v2004-20220812-en
5 signatures
150 seconds
General
-
Target
1668-57-0x0000000000160000-0x0000000000182000-memory.dll
-
Size
136KB
-
MD5
7c7b721ad4a481ac3aca9cafb9de37be
-
SHA1
d9cb5a24490fddd530e434634c6b4d90576ab7f3
-
SHA256
f0e76fb2b631554f0ce210b0edce39bab6f12ce9df027cb039096f1ca81b7ca8
-
SHA512
fbceb712d12721e72146c737357a60afc7cc945d7c511b82b978e812f1c1ce5ccf11838ba19fcccb5cd4d28b4fc73f77cc0f4ef93b0bcbf3568c0a2aae246690
-
SSDEEP
3072:24sJq26Cvn0sLSAIJ2aHUYtlTBfdUeZT:fCkCvnt3IJnHUUlTB17Z
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1404 wrote to memory of 1536 1404 rundll32.exe 28 PID 1404 wrote to memory of 1536 1404 rundll32.exe 28 PID 1404 wrote to memory of 1536 1404 rundll32.exe 28 PID 1404 wrote to memory of 1536 1404 rundll32.exe 28 PID 1404 wrote to memory of 1536 1404 rundll32.exe 28 PID 1404 wrote to memory of 1536 1404 rundll32.exe 28 PID 1404 wrote to memory of 1536 1404 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-57-0x0000000000160000-0x0000000000182000-memory.dll,#12⤵PID:1536
-