Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
25-08-2023 06:59
Static task
static1
Behavioral task
behavioral1
Sample
a0b67bd304c52a42d59664b12e3402b2710a91c6c22fd75762c9a17bad7add82.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
a0b67bd304c52a42d59664b12e3402b2710a91c6c22fd75762c9a17bad7add82.dll
Resource
win10v2004-20230703-en
General
-
Target
a0b67bd304c52a42d59664b12e3402b2710a91c6c22fd75762c9a17bad7add82.dll
-
Size
48KB
-
MD5
6096d9a115212326ea190ca0fc8395e2
-
SHA1
1aac95ccaa11c685b3b2fe8160a6ef068d1df2d4
-
SHA256
a0b67bd304c52a42d59664b12e3402b2710a91c6c22fd75762c9a17bad7add82
-
SHA512
20c08da53760aee1e35b272266ba6efe8b2707d26cf8474d557505ddf0c9ddeae06866174a7c4fa0d99ca81cca447f4afa5868f8d2490d060348b34c2d17416b
-
SSDEEP
768:3+1Uiu/hVtHrTcwQRaAeP4DDGVm9HSXl6dDYI:OqZtrYwEfZDGAZQ6dDYI
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 948 wrote to memory of 2648 948 rundll32.exe 28 PID 948 wrote to memory of 2648 948 rundll32.exe 28 PID 948 wrote to memory of 2648 948 rundll32.exe 28 PID 948 wrote to memory of 2648 948 rundll32.exe 28 PID 948 wrote to memory of 2648 948 rundll32.exe 28 PID 948 wrote to memory of 2648 948 rundll32.exe 28 PID 948 wrote to memory of 2648 948 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a0b67bd304c52a42d59664b12e3402b2710a91c6c22fd75762c9a17bad7add82.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a0b67bd304c52a42d59664b12e3402b2710a91c6c22fd75762c9a17bad7add82.dll,#12⤵PID:2648
-