Analysis
-
max time kernel
56s -
max time network
73s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
22-06-2023 13:57
Behavioral task
behavioral1
Sample
e53d7ba028f3df8918c7447db0e05df8.dll
Resource
win7-20230621-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
e53d7ba028f3df8918c7447db0e05df8.dll
Resource
win10v2004-20230621-en
1 signatures
150 seconds
General
-
Target
e53d7ba028f3df8918c7447db0e05df8.dll
-
Size
54KB
-
MD5
e53d7ba028f3df8918c7447db0e05df8
-
SHA1
4de1985e2bb5401ab665301432b30137f8d9b4f2
-
SHA256
1440bc84cd404b9a3712955f77ea0ae06ca2a07b7c441ef261bc4407dd4f8877
-
SHA512
da78658c6f7f99272909590aca7f5eb55409409e9e201841a7afa011effdefd30a1e6dec31749338ffe6b509fd1798f98927eac3cc4b2e77f5a0bd4f7ee67154
-
SSDEEP
1536:lDm8aNg+j7Ahr26oXZzZZpAsWnBCcdGje5WcA:7aNHmq6oXZzZT+jGjeB
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4220 wrote to memory of 2148 4220 rundll32.exe rundll32.exe PID 4220 wrote to memory of 2148 4220 rundll32.exe rundll32.exe PID 4220 wrote to memory of 2148 4220 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e53d7ba028f3df8918c7447db0e05df8.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e53d7ba028f3df8918c7447db0e05df8.dll,#12⤵