Analysis
-
max time kernel
31s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
28/02/2023, 11:20
Static task
static1
Behavioral task
behavioral1
Sample
StrangulatorySubduedness.dll
Resource
win7-20230220-en
2 signatures
150 seconds
General
-
Target
StrangulatorySubduedness.dll
-
Size
348KB
-
MD5
842ff3818aab3bc168f997aa43163434
-
SHA1
ba69ce91bcc57883ed2989749a9c05c2ef8bd899
-
SHA256
628b7be2f1bb39f173458d0595ddfed907157ef25a574d34faaa4bfd80129071
-
SHA512
57c7ce4fd461e0b6d8599f68cd9dedf382f5cec1c70cb599a90964fa1a8d2c07e6397587bb69b65662de2bc45e582acbe723e0909282fb2a7bf4ec5243434282
-
SSDEEP
6144:znCkEzy3WOKrHe7EPvIbQP952w7QNlC20wHa8zbC6+fYyf9unVes12qxWCla8aGN:NEyrw2s20wHao+mmeWCl9Vdsd
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1912 1916 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 908 wrote to memory of 1916 908 rundll32.exe 27 PID 908 wrote to memory of 1916 908 rundll32.exe 27 PID 908 wrote to memory of 1916 908 rundll32.exe 27 PID 908 wrote to memory of 1916 908 rundll32.exe 27 PID 908 wrote to memory of 1916 908 rundll32.exe 27 PID 908 wrote to memory of 1916 908 rundll32.exe 27 PID 908 wrote to memory of 1916 908 rundll32.exe 27 PID 1916 wrote to memory of 1912 1916 rundll32.exe 28 PID 1916 wrote to memory of 1912 1916 rundll32.exe 28 PID 1916 wrote to memory of 1912 1916 rundll32.exe 28 PID 1916 wrote to memory of 1912 1916 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\StrangulatorySubduedness.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\StrangulatorySubduedness.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 2243⤵
- Program crash
PID:1912
-
-