Analysis
-
max time kernel
45s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
03/02/2023, 09:01
Behavioral task
behavioral1
Sample
1796-57-0x0000000000720000-0x0000000000743000-memory.dll
Resource
win7-20220901-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
1796-57-0x0000000000720000-0x0000000000743000-memory.dll
Resource
win10v2004-20220812-en
1 signatures
150 seconds
General
-
Target
1796-57-0x0000000000720000-0x0000000000743000-memory.dll
-
Size
140KB
-
MD5
0cd1c6716009533bed2d47ae0ae51d45
-
SHA1
8a4d7ac33738ffcd4e3d34d75a28aa32afd6f17d
-
SHA256
4345341f6c062c955f5d7dc811135bbe5a26685c773d521f081a19218e86aceb
-
SHA512
a3e0107b2e304c221174c2758b3ed99cebbff2c1fffee000f795501386cc064330a03e3ff890c62bc643fe6b8d32231cee65ea9627fedce780f2f34e9ecc41cc
-
SSDEEP
3072:38CrZ6LBimQTHPQ4ZRsQyAjJjARvMDTBf/1gA:j6LBimYvQZQXjJMRvMDTBX1g
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1808 wrote to memory of 1056 1808 rundll32.exe 27 PID 1808 wrote to memory of 1056 1808 rundll32.exe 27 PID 1808 wrote to memory of 1056 1808 rundll32.exe 27 PID 1808 wrote to memory of 1056 1808 rundll32.exe 27 PID 1808 wrote to memory of 1056 1808 rundll32.exe 27 PID 1808 wrote to memory of 1056 1808 rundll32.exe 27 PID 1808 wrote to memory of 1056 1808 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x0000000000720000-0x0000000000743000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x0000000000720000-0x0000000000743000-memory.dll,#12⤵PID:1056
-