Analysis
-
max time kernel
28s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
02-06-2023 11:30
Behavioral task
behavioral1
Sample
1664-135-0x00000000025F0000-0x0000000002614000-memory.dll
Resource
win7-20230220-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
1664-135-0x00000000025F0000-0x0000000002614000-memory.dll
Resource
win10v2004-20230220-en
5 signatures
150 seconds
General
-
Target
1664-135-0x00000000025F0000-0x0000000002614000-memory.dll
-
Size
144KB
-
MD5
17c3f09ada58bab6f8a5a99e8aeb0dda
-
SHA1
6ab2ead18ded5f079b73c1b965e9fc4f6bd5670c
-
SHA256
99f4e69547825a4142deb88fa0a51ab042589b14e83b7bb9d2e983aeaec4afed
-
SHA512
1059ab0b6ddc551b166db36892a1adc499c59f833b727a9842a6b790890b5b956b9bf901300aad77d6ee5342cd3cce808dbe4f1d7c3a02a6d8de3fd27591a169
-
SSDEEP
3072:ju2U5b2bjWk3NDjXVAdhJf/lOMTBfwVFWLL:xlbjWgNXXmdhJXlOMTBIPK
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 828 wrote to memory of 1136 828 rundll32.exe rundll32.exe PID 828 wrote to memory of 1136 828 rundll32.exe rundll32.exe PID 828 wrote to memory of 1136 828 rundll32.exe rundll32.exe PID 828 wrote to memory of 1136 828 rundll32.exe rundll32.exe PID 828 wrote to memory of 1136 828 rundll32.exe rundll32.exe PID 828 wrote to memory of 1136 828 rundll32.exe rundll32.exe PID 828 wrote to memory of 1136 828 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1664-135-0x00000000025F0000-0x0000000002614000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1664-135-0x00000000025F0000-0x0000000002614000-memory.dll,#12⤵PID:1136