Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25/12/2022, 22:51
Behavioral task
behavioral1
Sample
2004-57-0x0000000000200000-0x0000000000222000-memory.dll
Resource
win7-20221111-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2004-57-0x0000000000200000-0x0000000000222000-memory.dll
Resource
win10v2004-20220812-en
1 signatures
150 seconds
General
-
Target
2004-57-0x0000000000200000-0x0000000000222000-memory.dll
-
Size
136KB
-
MD5
1fc83be14728d5cd9d3d72de51687431
-
SHA1
bf6a1c7adcbd248b019bc3acc2583f27c7641097
-
SHA256
b786fd14eef7652bfad84e94197262849178ca1d5671d4b27e378b536d047830
-
SHA512
7d6ba546edf4d6c75287c3e1528de960fccc1a2f4a315a1fb96dd6ddfb492fa1f3beb566bb98d811bebb993bf5f29677950d2fffb147e8882f2c694cf2af7d6e
-
SSDEEP
1536:YhO31RQaZMAC5CZ2qClG0gOhAARMBAzHwJleg6IiIODdnToIfJB0egrzkJ:IO2K2qSG0zhAekAEJkgzAhTBfJqeZJ
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1292 wrote to memory of 1268 1292 rundll32.exe 28 PID 1292 wrote to memory of 1268 1292 rundll32.exe 28 PID 1292 wrote to memory of 1268 1292 rundll32.exe 28 PID 1292 wrote to memory of 1268 1292 rundll32.exe 28 PID 1292 wrote to memory of 1268 1292 rundll32.exe 28 PID 1292 wrote to memory of 1268 1292 rundll32.exe 28 PID 1292 wrote to memory of 1268 1292 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2004-57-0x0000000000200000-0x0000000000222000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2004-57-0x0000000000200000-0x0000000000222000-memory.dll,#12⤵PID:1268
-