Analysis
-
max time kernel
30s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230705-en -
resource tags
arch:x64arch:x86image:win7-20230705-enlocale:en-usos:windows7-x64system -
submitted
12/07/2023, 01:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a8be152aaa74769e858feb404cf626063923b424070f002736181fe605779b3c.dll
Resource
win7-20230705-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
a8be152aaa74769e858feb404cf626063923b424070f002736181fe605779b3c.dll
Resource
win10v2004-20230703-en
1 signatures
150 seconds
General
-
Target
a8be152aaa74769e858feb404cf626063923b424070f002736181fe605779b3c.dll
-
Size
1.0MB
-
MD5
3f77e44c11a9969bfbcdd0c74fe8741e
-
SHA1
7da73a68ba2e2381f6a6b10a8dd29b3d3f3ee5d2
-
SHA256
a8be152aaa74769e858feb404cf626063923b424070f002736181fe605779b3c
-
SHA512
d14e0d43dfa328a3c1e1e2648e0b87c7790d5b25a010ff39211bd5a7be271a8342a12728cf027207ca8a35e48ed1b2c7965a8a25a7281a2192ec1ecf94103ace
-
SSDEEP
24576:9LdgorRNAXPWHuMgN7sQeUWMOkyByxCmtYzQ6Y:B72kBg6+v6
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2892 wrote to memory of 2908 2892 rundll32.exe 27 PID 2892 wrote to memory of 2908 2892 rundll32.exe 27 PID 2892 wrote to memory of 2908 2892 rundll32.exe 27 PID 2892 wrote to memory of 2908 2892 rundll32.exe 27 PID 2892 wrote to memory of 2908 2892 rundll32.exe 27 PID 2892 wrote to memory of 2908 2892 rundll32.exe 27 PID 2892 wrote to memory of 2908 2892 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a8be152aaa74769e858feb404cf626063923b424070f002736181fe605779b3c.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a8be152aaa74769e858feb404cf626063923b424070f002736181fe605779b3c.dll,#12⤵PID:2908
-