Analysis
-
max time kernel
31s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
02-06-2023 11:07
Behavioral task
behavioral1
Sample
1784-83-0x0000000000150000-0x0000000000174000-memory.dll
Resource
win7-20230220-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
1784-83-0x0000000000150000-0x0000000000174000-memory.dll
Resource
win10v2004-20230220-en
1 signatures
150 seconds
General
-
Target
1784-83-0x0000000000150000-0x0000000000174000-memory.dll
-
Size
144KB
-
MD5
007b8fdbcc0c58d8be63d4bd4628fdc4
-
SHA1
4a670301226027ecfd685231498ef81a64bed77d
-
SHA256
0b3331251141897166fb13b5ddf91c43a470fa206232394140785ce3ab87bb75
-
SHA512
59979f653c0e995d750f6694356e9e0db0c06a75ba2113e542aaa85c16c205fd616150a0d3c1a368e986bf5976ed4f93114a3fce3a17474493a012157fefa435
-
SSDEEP
3072:HaL532eGHtnHxJtPXFBxA55JrXhcQTBfA3OLR:jnH1HxJtvFB655JLhcQTB43S
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 836 wrote to memory of 1176 836 rundll32.exe rundll32.exe PID 836 wrote to memory of 1176 836 rundll32.exe rundll32.exe PID 836 wrote to memory of 1176 836 rundll32.exe rundll32.exe PID 836 wrote to memory of 1176 836 rundll32.exe rundll32.exe PID 836 wrote to memory of 1176 836 rundll32.exe rundll32.exe PID 836 wrote to memory of 1176 836 rundll32.exe rundll32.exe PID 836 wrote to memory of 1176 836 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1784-83-0x0000000000150000-0x0000000000174000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1784-83-0x0000000000150000-0x0000000000174000-memory.dll,#12⤵PID:1176
-