Analysis
-
max time kernel
82s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
11-05-2023 14:34
Behavioral task
behavioral1
Sample
1772-56-0x0000000000900000-0x0000000000924000-memory.dll
Resource
win7-20230220-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
1772-56-0x0000000000900000-0x0000000000924000-memory.dll
Resource
win10v2004-20230220-en
1 signatures
150 seconds
General
-
Target
1772-56-0x0000000000900000-0x0000000000924000-memory.dll
-
Size
144KB
-
MD5
10ee080c463e43de482ea6afdd87f91b
-
SHA1
5df7aeca1ebeee201e10e720eccfdd990dd9fa9f
-
SHA256
a2b2e0253453203cc374a0fbeadc7271d88ae39870c8b14d5df0e8b71eae588c
-
SHA512
24e3b625c837e526cc0a79c6c028cf6cf66ea560c7af06f1a06ed59b23f8f2cab78f4ef51c604ea55594425c5c385fa52712a4b40515468d485deddf2362234f
-
SSDEEP
3072:wnwDHspKaOdWud1rVnFcEs+M7AHJ4PHZ8TBf/sN1Tg:FkwUuHZFi+9HJoHZ8TB3sN6
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
rundll32.exerundll32.exedescription pid Process procid_target PID 2432 wrote to memory of 1296 2432 rundll32.exe 86 PID 2432 wrote to memory of 1296 2432 rundll32.exe 86 PID 2432 wrote to memory of 1296 2432 rundll32.exe 86 PID 1296 wrote to memory of 4680 1296 rundll32.exe 87 PID 1296 wrote to memory of 4680 1296 rundll32.exe 87 PID 1296 wrote to memory of 4680 1296 rundll32.exe 87
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1772-56-0x0000000000900000-0x0000000000924000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1772-56-0x0000000000900000-0x0000000000924000-memory.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1772-56-0x0000000000900000-0x0000000000924000-memory.dll,#13⤵PID:4680
-
-