Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
02-06-2023 23:13
Behavioral task
behavioral1
Sample
1592-83-0x0000000000150000-0x0000000000174000-memory.dll
Resource
win7-20230220-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
1592-83-0x0000000000150000-0x0000000000174000-memory.dll
Resource
win10v2004-20230220-en
1 signatures
150 seconds
General
-
Target
1592-83-0x0000000000150000-0x0000000000174000-memory.dll
-
Size
144KB
-
MD5
2708a8e4ab72c9169739d941d734348e
-
SHA1
0923952e6a0dc4e973c27ef0071c65f300313a6d
-
SHA256
5b49f0d0e6fab814d688b8dbb1692a7c9c45bd278ad348d053dd056788e7b66b
-
SHA512
c84105127c80d2de2976bd8ce3fafc0a0414385aa4e0a63ae14acb38cc155f346cc9174fa503006b1e8b8634fa9620fd732614ec8ab14c114b5f7040bc701401
-
SSDEEP
3072:Gz+RS+Cmyw5yFQC3x61e6RdAr9JDYhdoTBfAvoLVr:o+543x61zR+r9J8hdoTB4vI
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1768 wrote to memory of 1628 1768 rundll32.exe rundll32.exe PID 1768 wrote to memory of 1628 1768 rundll32.exe rundll32.exe PID 1768 wrote to memory of 1628 1768 rundll32.exe rundll32.exe PID 1768 wrote to memory of 1628 1768 rundll32.exe rundll32.exe PID 1768 wrote to memory of 1628 1768 rundll32.exe rundll32.exe PID 1768 wrote to memory of 1628 1768 rundll32.exe rundll32.exe PID 1768 wrote to memory of 1628 1768 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1592-83-0x0000000000150000-0x0000000000174000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1592-83-0x0000000000150000-0x0000000000174000-memory.dll,#12⤵PID:1628