Analysis
-
max time kernel
31s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
11-05-2023 14:34
Behavioral task
behavioral1
Sample
1772-56-0x0000000000900000-0x0000000000924000-memory.dll
Resource
win7-20230220-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
1772-56-0x0000000000900000-0x0000000000924000-memory.dll
Resource
win10v2004-20230220-en
1 signatures
150 seconds
General
-
Target
1772-56-0x0000000000900000-0x0000000000924000-memory.dll
-
Size
144KB
-
MD5
10ee080c463e43de482ea6afdd87f91b
-
SHA1
5df7aeca1ebeee201e10e720eccfdd990dd9fa9f
-
SHA256
a2b2e0253453203cc374a0fbeadc7271d88ae39870c8b14d5df0e8b71eae588c
-
SHA512
24e3b625c837e526cc0a79c6c028cf6cf66ea560c7af06f1a06ed59b23f8f2cab78f4ef51c604ea55594425c5c385fa52712a4b40515468d485deddf2362234f
-
SSDEEP
3072:wnwDHspKaOdWud1rVnFcEs+M7AHJ4PHZ8TBf/sN1Tg:FkwUuHZFi+9HJoHZ8TB3sN6
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid Process procid_target PID 1580 wrote to memory of 1692 1580 rundll32.exe 28 PID 1580 wrote to memory of 1692 1580 rundll32.exe 28 PID 1580 wrote to memory of 1692 1580 rundll32.exe 28 PID 1580 wrote to memory of 1692 1580 rundll32.exe 28 PID 1580 wrote to memory of 1692 1580 rundll32.exe 28 PID 1580 wrote to memory of 1692 1580 rundll32.exe 28 PID 1580 wrote to memory of 1692 1580 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1772-56-0x0000000000900000-0x0000000000924000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1772-56-0x0000000000900000-0x0000000000924000-memory.dll,#12⤵PID:1692
-