Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
02-06-2023 23:08
Behavioral task
behavioral1
Sample
1100-157-0x0000000000220000-0x0000000000244000-memory.dll
Resource
win7-20230220-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
1100-157-0x0000000000220000-0x0000000000244000-memory.dll
Resource
win10v2004-20230220-en
1 signatures
150 seconds
General
-
Target
1100-157-0x0000000000220000-0x0000000000244000-memory.dll
-
Size
144KB
-
MD5
12c9013c506da572a30d0c6e7934a05f
-
SHA1
0bb9caf1444ab24d2ac8249532869ad9d7c5bdc4
-
SHA256
b64787b884905aaa67a85ef040f69a7576f38a860cb5c51c0414fdbd398410cd
-
SHA512
c12d25a322c970c09c6b2c08918b0e36a7ad6b7154ec62ffcad058f4ccbdd749a8688902a54f46aeec20cca5774b3f780581050c239d2b981e6db9fff7e73d66
-
SSDEEP
3072:G1K9S39hBZGSagw/uAS3J83LPsTBfwgcLgr:0hBcgybS3JMLPsTBogk
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1132 wrote to memory of 1184 1132 rundll32.exe rundll32.exe PID 1132 wrote to memory of 1184 1132 rundll32.exe rundll32.exe PID 1132 wrote to memory of 1184 1132 rundll32.exe rundll32.exe PID 1132 wrote to memory of 1184 1132 rundll32.exe rundll32.exe PID 1132 wrote to memory of 1184 1132 rundll32.exe rundll32.exe PID 1132 wrote to memory of 1184 1132 rundll32.exe rundll32.exe PID 1132 wrote to memory of 1184 1132 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1100-157-0x0000000000220000-0x0000000000244000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1100-157-0x0000000000220000-0x0000000000244000-memory.dll,#12⤵PID:1184