Analysis
-
max time kernel
133s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02/02/2023, 13:41
Behavioral task
behavioral1
Sample
PerX.exe
Resource
win7-20221111-en
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
PerX.exe
Resource
win10v2004-20221111-en
22 signatures
150 seconds
Behavioral task
behavioral3
Sample
Scarletz.dll
Resource
win7-20221111-en
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
Scarletz.dll
Resource
win10v2004-20220812-en
2 signatures
150 seconds
General
-
Target
Scarletz.dll
-
Size
44KB
-
MD5
d6657152a962d3616bb217d1ed0d36f8
-
SHA1
3eed106977fe7ef85476d6942e25a7f447919a21
-
SHA256
967cd5507ec757106b12126a0679fbe7290af92041db787c18455e333f0ea8ec
-
SHA512
5f5061f108d532a966376adf5a4ab5c7b04e644a77064915d8bc512c9f3d416a5d3d8adf8de3a86e5f472ed4423662799609d0672b11769bbdafaf621e07ed0b
-
SSDEEP
768:aGmM0xoDvpJZkhyiJhqIcIZKOrG6CaNYx8OnfmO7:ahKdJKhyiSIaOr5NYLT
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral4/memory/5100-133-0x000000006E240000-0x000000006E24E000-memory.dmp vmprotect -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 820 wrote to memory of 5100 820 rundll32.exe 81 PID 820 wrote to memory of 5100 820 rundll32.exe 81 PID 820 wrote to memory of 5100 820 rundll32.exe 81