Analysis
-
max time kernel
82s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
22-06-2023 14:02
Behavioral task
behavioral1
Sample
1440bc84cd404b9a3712955f77ea0ae06ca2a07b7c441ef261bc4407dd4f8877.dll
Resource
win10v2004-20230621-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
1440bc84cd404b9a3712955f77ea0ae06ca2a07b7c441ef261bc4407dd4f8877.dll
-
Size
54KB
-
MD5
e53d7ba028f3df8918c7447db0e05df8
-
SHA1
4de1985e2bb5401ab665301432b30137f8d9b4f2
-
SHA256
1440bc84cd404b9a3712955f77ea0ae06ca2a07b7c441ef261bc4407dd4f8877
-
SHA512
da78658c6f7f99272909590aca7f5eb55409409e9e201841a7afa011effdefd30a1e6dec31749338ffe6b509fd1798f98927eac3cc4b2e77f5a0bd4f7ee67154
-
SSDEEP
1536:lDm8aNg+j7Ahr26oXZzZZpAsWnBCcdGje5WcA:7aNHmq6oXZzZT+jGjeB
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 2416 wrote to memory of 4912 2416 rundll32.exe rundll32.exe PID 2416 wrote to memory of 4912 2416 rundll32.exe rundll32.exe PID 2416 wrote to memory of 4912 2416 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1440bc84cd404b9a3712955f77ea0ae06ca2a07b7c441ef261bc4407dd4f8877.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1440bc84cd404b9a3712955f77ea0ae06ca2a07b7c441ef261bc4407dd4f8877.dll,#12⤵PID:4912