Analysis
-
max time kernel
148s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
01-08-2023 07:49
Static task
static1
Behavioral task
behavioral1
Sample
b2c6ade0e8aade3b20815e938378b2d9aeb43bd9a94220e8a8162d8230dd0c59.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
b2c6ade0e8aade3b20815e938378b2d9aeb43bd9a94220e8a8162d8230dd0c59.dll
Resource
win10v2004-20230703-en
General
-
Target
b2c6ade0e8aade3b20815e938378b2d9aeb43bd9a94220e8a8162d8230dd0c59.dll
-
Size
1.3MB
-
MD5
ebe800179a2c4e9894559ae4426f6198
-
SHA1
b6c125a73ff30215a908196da776fa5f1ac75879
-
SHA256
b2c6ade0e8aade3b20815e938378b2d9aeb43bd9a94220e8a8162d8230dd0c59
-
SHA512
3d6efe9b47218bb4e7b376637ab547189fa5d4b43c73d07605f74ddcdcb0b939eec7b70b03f214cbb0fd0287d1f81d599745b6ef5f4408c2e82ab58ae57aab4b
-
SSDEEP
24576:wqFSjZ4h7POKX1UshOrD5CWQ70BN8uum94+BHL3PN:wqFSqh7mdsI3ozug+ZDPN
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2212 wrote to memory of 3372 2212 rundll32.exe 84 PID 2212 wrote to memory of 3372 2212 rundll32.exe 84 PID 2212 wrote to memory of 3372 2212 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b2c6ade0e8aade3b20815e938378b2d9aeb43bd9a94220e8a8162d8230dd0c59.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b2c6ade0e8aade3b20815e938378b2d9aeb43bd9a94220e8a8162d8230dd0c59.dll,#12⤵PID:3372
-