Analysis
-
max time kernel
31s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
07-06-2023 19:20
Behavioral task
behavioral1
Sample
3b0e3c285673f1e28af37eb24bbb8fc64159a684ddb931132fb7ccd9f6857dcc.dll
Resource
win7-20230220-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
3b0e3c285673f1e28af37eb24bbb8fc64159a684ddb931132fb7ccd9f6857dcc.dll
Resource
win10v2004-20230221-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
3b0e3c285673f1e28af37eb24bbb8fc64159a684ddb931132fb7ccd9f6857dcc.dll
-
Size
952KB
-
MD5
8a732a0ff80542045e3504a501ff816e
-
SHA1
1076601234dc31622af7ef7fe957508754b525a9
-
SHA256
3b0e3c285673f1e28af37eb24bbb8fc64159a684ddb931132fb7ccd9f6857dcc
-
SHA512
8a7aab8fccde89792e5896cc930d61957c525de4a1a2f90cc18ebb59eb933879daa7fddb146c705ef0dffce66723dd234f28b90d2310d73a004332209748f57a
-
SSDEEP
24576:64W35M4TRtWj22TO3wF/sRAoL/anfgfPXnQcnq7uhP/M+:6P5MYF2TWW/NcXnQcq7q3d
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1728 wrote to memory of 1740 1728 rundll32.exe rundll32.exe PID 1728 wrote to memory of 1740 1728 rundll32.exe rundll32.exe PID 1728 wrote to memory of 1740 1728 rundll32.exe rundll32.exe PID 1728 wrote to memory of 1740 1728 rundll32.exe rundll32.exe PID 1728 wrote to memory of 1740 1728 rundll32.exe rundll32.exe PID 1728 wrote to memory of 1740 1728 rundll32.exe rundll32.exe PID 1728 wrote to memory of 1740 1728 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3b0e3c285673f1e28af37eb24bbb8fc64159a684ddb931132fb7ccd9f6857dcc.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3b0e3c285673f1e28af37eb24bbb8fc64159a684ddb931132fb7ccd9f6857dcc.dll,#12⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1740-54-0x0000000001DE0000-0x000000000222C000-memory.dmpFilesize
4.3MB