Analysis
-
max time kernel
139s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
01/08/2023, 04:27
Static task
static1
Behavioral task
behavioral1
Sample
8897b93126ad83070840200b8a449fe5dd7abd55c4bc54330229c296183f67f7.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
8897b93126ad83070840200b8a449fe5dd7abd55c4bc54330229c296183f67f7.dll
Resource
win10v2004-20230703-en
General
-
Target
8897b93126ad83070840200b8a449fe5dd7abd55c4bc54330229c296183f67f7.dll
-
Size
1.3MB
-
MD5
68de6734468567ec43fd3783eb439568
-
SHA1
5476393e6b6d37104e3ce9c85064d595e500d0dc
-
SHA256
8897b93126ad83070840200b8a449fe5dd7abd55c4bc54330229c296183f67f7
-
SHA512
5ebb48dac422ea38c26172d0c0278e7345e39fd33d90f798126c76858d845f4319f13d9d9740ad16d3eee820b5d0a0b2d3619b3afc0c94911b3b2f57c09e7c7a
-
SSDEEP
24576:e2SjZ4h7POKX1UshOrD5CWQ70BN8uum94+BHL3PQ:e2Sqh7mdsI3ozug+ZDPQ
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1200 wrote to memory of 3956 1200 rundll32.exe 84 PID 1200 wrote to memory of 3956 1200 rundll32.exe 84 PID 1200 wrote to memory of 3956 1200 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8897b93126ad83070840200b8a449fe5dd7abd55c4bc54330229c296183f67f7.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8897b93126ad83070840200b8a449fe5dd7abd55c4bc54330229c296183f67f7.dll,#12⤵PID:3956
-