Analysis
-
max time kernel
30s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
12-02-2023 19:05
Behavioral task
behavioral1
Sample
0bba215454262acfe65080fbb60feede65c5847a649f7335fe6b76d8bd744ab7.dll
Resource
win7-20220812-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
0bba215454262acfe65080fbb60feede65c5847a649f7335fe6b76d8bd744ab7.dll
Resource
win10v2004-20220901-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
0bba215454262acfe65080fbb60feede65c5847a649f7335fe6b76d8bd744ab7.dll
-
Size
1.9MB
-
MD5
13cd2e056feaeaad728ceebe5afbf1cf
-
SHA1
97c6eaaaa13beaef8fe6c2dd4d278eca0ca4a77e
-
SHA256
0bba215454262acfe65080fbb60feede65c5847a649f7335fe6b76d8bd744ab7
-
SHA512
97753991e92639cb3f3db08cf2a4439315d05d5ec4f367ba9d9da417fc23288301594261deb1e86400cb26e431c58c42571c95855e33eda3e57bc23aaa611ed5
-
SSDEEP
49152:FS8EBxM6azpOrHwGqInbFcJxigZbzl9+TH7:FS8EBx3CwrQGqIbgxfoH7
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1492 wrote to memory of 904 1492 rundll32.exe rundll32.exe PID 1492 wrote to memory of 904 1492 rundll32.exe rundll32.exe PID 1492 wrote to memory of 904 1492 rundll32.exe rundll32.exe PID 1492 wrote to memory of 904 1492 rundll32.exe rundll32.exe PID 1492 wrote to memory of 904 1492 rundll32.exe rundll32.exe PID 1492 wrote to memory of 904 1492 rundll32.exe rundll32.exe PID 1492 wrote to memory of 904 1492 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0bba215454262acfe65080fbb60feede65c5847a649f7335fe6b76d8bd744ab7.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0bba215454262acfe65080fbb60feede65c5847a649f7335fe6b76d8bd744ab7.dll,#12⤵PID:904