Overview
overview
10Static
static
1t.zip
windows7-x64
1t.zip
windows10-2004-x64
1t/SmadHook32.dll
windows7-x64
1t/SmadHook32.dll
windows10-2004-x64
1t/Smadav.dat
windows7-x64
3t/Smadav.dat
windows10-2004-x64
3t/Smadav.exe
windows7-x64
10t/Smadav.exe
windows10-2004-x64
10t/setupres.dll
windows7-x64
1t/setupres.dll
windows10-2004-x64
1Analysis
-
max time kernel
43s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
15-02-2023 14:00
Static task
static1
Behavioral task
behavioral1
Sample
t.zip
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
t.zip
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
t/SmadHook32.dll
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
t/SmadHook32.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral5
Sample
t/Smadav.dat
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
t/Smadav.dat
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
t/Smadav.exe
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
t/Smadav.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
t/setupres.dll
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
t/setupres.dll
Resource
win10v2004-20221111-en
General
-
Target
t/SmadHook32.dll
-
Size
70KB
-
MD5
e1ed9b48016d43398cdf62a61c9b113d
-
SHA1
b8e7183fba57ca867393ea4edf62fe60d1549c94
-
SHA256
2e0b20fd34c70ec0566cb6e0852520fbab9452e3cb7aad8299ae841ac71733cf
-
SHA512
4b5fd58c0d6a59d710d80f0bec216ba19d9e52c1516d799a991995bd7a9f6e45667f924ef7b7320773881d521a1059bb8a2686e1324ed8083c10ca68e1f48714
-
SSDEEP
1536:24Hd4iaPI1/zhAP6YtnogaDc8zvsWjcdS78a:czw1/zeMzQSX
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1788 wrote to memory of 1628 1788 rundll32.exe 27 PID 1788 wrote to memory of 1628 1788 rundll32.exe 27 PID 1788 wrote to memory of 1628 1788 rundll32.exe 27 PID 1788 wrote to memory of 1628 1788 rundll32.exe 27 PID 1788 wrote to memory of 1628 1788 rundll32.exe 27 PID 1788 wrote to memory of 1628 1788 rundll32.exe 27 PID 1788 wrote to memory of 1628 1788 rundll32.exe 27