Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
06-06-2023 18:53
Static task
static1
Behavioral task
behavioral1
Sample
qak.bat
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
qak.bat
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
qak.dll
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
qak.dll
Resource
win10v2004-20230220-en
General
-
Target
qak.dll
-
Size
496KB
-
MD5
179d4849f8d096122d05de3c7bebb4bd
-
SHA1
ee3ead69ec6801721cde4ca6480f30ecff948c08
-
SHA256
2f6ae770a5d56ed8a2cfe262e196363b5c80e58468c66ff36cdf9c75306c2c55
-
SHA512
f449ac3cba0d31168328f3e0af94bb91f2f2d1c2a9ec3e4200d4f946973a2ac34bc3e42f10fa03c433d1eb89f131e39ada44f2cc921c836b35e56efeac62cdfe
-
SSDEEP
12288:W5XwIjvPgzGgQChM5u/7hIYArytfqYsgzelZ7CPZUeQ58:njhhArytfqYsgalZWPRQ58
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 948 wrote to memory of 896 948 rundll32.exe rundll32.exe PID 948 wrote to memory of 896 948 rundll32.exe rundll32.exe PID 948 wrote to memory of 896 948 rundll32.exe rundll32.exe PID 948 wrote to memory of 896 948 rundll32.exe rundll32.exe PID 948 wrote to memory of 896 948 rundll32.exe rundll32.exe PID 948 wrote to memory of 896 948 rundll32.exe rundll32.exe PID 948 wrote to memory of 896 948 rundll32.exe rundll32.exe