Analysis
-
max time kernel
30s -
max time network
32s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
08-06-2023 19:06
Behavioral task
behavioral1
Sample
6bc591fb8355e4d45b732a99d780f10881557ccdd6c0ccfa0ee2cee95f1bb77b.dll
Resource
win7-20230220-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
6bc591fb8355e4d45b732a99d780f10881557ccdd6c0ccfa0ee2cee95f1bb77b.dll
Resource
win10v2004-20230221-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
6bc591fb8355e4d45b732a99d780f10881557ccdd6c0ccfa0ee2cee95f1bb77b.dll
-
Size
213KB
-
MD5
55c100f65c5e83bd20010cf72ab41e91
-
SHA1
82fb3953f2db6f52085e7f31e2922b512a539083
-
SHA256
6bc591fb8355e4d45b732a99d780f10881557ccdd6c0ccfa0ee2cee95f1bb77b
-
SHA512
9a4c69b5e22211a607ba12efd2bf7cfad0131259b84d7066563781691f4a8147170cc96ce8dabc454a4ca4169d0661d86721eb681f0bd9acb601f61d49e83ed9
-
SSDEEP
6144:6p13n+qMlWhPolvtcd+CM0TnX1n/Ljs5YNnaHc0sYyv4/:M1X1thQlvtcd+Cl7X1n/LEYNaHc0g
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1600 wrote to memory of 940 1600 rundll32.exe rundll32.exe PID 1600 wrote to memory of 940 1600 rundll32.exe rundll32.exe PID 1600 wrote to memory of 940 1600 rundll32.exe rundll32.exe PID 1600 wrote to memory of 940 1600 rundll32.exe rundll32.exe PID 1600 wrote to memory of 940 1600 rundll32.exe rundll32.exe PID 1600 wrote to memory of 940 1600 rundll32.exe rundll32.exe PID 1600 wrote to memory of 940 1600 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6bc591fb8355e4d45b732a99d780f10881557ccdd6c0ccfa0ee2cee95f1bb77b.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6bc591fb8355e4d45b732a99d780f10881557ccdd6c0ccfa0ee2cee95f1bb77b.dll,#12⤵