Analysis
-
max time kernel
91s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
05-01-2023 00:40
Static task
static1
Behavioral task
behavioral1
Sample
3ec45659c2bc03e9e1a4d54d0476c06fe3ebfef8.dll
Resource
win7-20220812-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
3ec45659c2bc03e9e1a4d54d0476c06fe3ebfef8.dll
Resource
win10v2004-20221111-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
3ec45659c2bc03e9e1a4d54d0476c06fe3ebfef8.dll
-
Size
1.4MB
-
MD5
3e1b04282d2d7d5b48a6de81c34a564f
-
SHA1
3ec45659c2bc03e9e1a4d54d0476c06fe3ebfef8
-
SHA256
6fb0ad3f756b5d1f871cf34c3e4ea47cb34643cd17709a09c25076c400313adf
-
SHA512
a098efa2533cab955377480aedb81937fc5cb8caa84260528d309cd13ddfa7b1a28155d36355cb38f369d30e20125df50a6523884c152359c6b53655cf1a39d0
-
SSDEEP
24576:gsZLRYbIQfH9mE91jsNQtQ5dIiu0WdzVt8UoBWpCN2CmazALe7WzpmV:g8LRYb3HzePlu0wgKetqKWVm
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1352 wrote to memory of 2044 1352 rundll32.exe 80 PID 1352 wrote to memory of 2044 1352 rundll32.exe 80 PID 1352 wrote to memory of 2044 1352 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3ec45659c2bc03e9e1a4d54d0476c06fe3ebfef8.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3ec45659c2bc03e9e1a4d54d0476c06fe3ebfef8.dll,#12⤵PID:2044
-