Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230621-en -
resource tags
arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system -
submitted
22-06-2023 20:12
Behavioral task
behavioral1
Sample
667ec7cb8631205e4046dd694dd4e08a27f4a75b6e5765f97c08aa409261e799.dll
Resource
win7-20230621-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
667ec7cb8631205e4046dd694dd4e08a27f4a75b6e5765f97c08aa409261e799.dll
Resource
win10v2004-20230621-en
1 signatures
150 seconds
General
-
Target
667ec7cb8631205e4046dd694dd4e08a27f4a75b6e5765f97c08aa409261e799.dll
-
Size
430KB
-
MD5
4455c3c54aaa646fb4ff1896cb08fde4
-
SHA1
52b1b6429fc4e84d65e7e4e700cca96faa8e332c
-
SHA256
667ec7cb8631205e4046dd694dd4e08a27f4a75b6e5765f97c08aa409261e799
-
SHA512
0a06fea8161352398114d162813b71384b968bc1a776c150a57a5623e5ccfd338bf7348f02c8fba172cc6a03c158a2631f53e84633eb4ae3912650fcf9db894f
-
SSDEEP
12288:wMClQDsktgT+YvAh+S+ez+8yOc2RqXcY5YEd4DM6:wMClnke+zhJ+dxF
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 2028 wrote to memory of 2012 2028 rundll32.exe rundll32.exe PID 2028 wrote to memory of 2012 2028 rundll32.exe rundll32.exe PID 2028 wrote to memory of 2012 2028 rundll32.exe rundll32.exe PID 2028 wrote to memory of 2012 2028 rundll32.exe rundll32.exe PID 2028 wrote to memory of 2012 2028 rundll32.exe rundll32.exe PID 2028 wrote to memory of 2012 2028 rundll32.exe rundll32.exe PID 2028 wrote to memory of 2012 2028 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\667ec7cb8631205e4046dd694dd4e08a27f4a75b6e5765f97c08aa409261e799.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\667ec7cb8631205e4046dd694dd4e08a27f4a75b6e5765f97c08aa409261e799.dll,#12⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2012-54-0x0000000002100000-0x0000000002401000-memory.dmpFilesize
3.0MB