Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
30/08/2023, 18:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9a5f7ec7f887d02cd09908901bdf584633dc0617830248798fe2af215790b042.dll
Resource
win7-20230712-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
9a5f7ec7f887d02cd09908901bdf584633dc0617830248798fe2af215790b042.dll
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
9a5f7ec7f887d02cd09908901bdf584633dc0617830248798fe2af215790b042.dll
-
Size
836KB
-
MD5
78ba16f00ad91942748f7434a6f422e1
-
SHA1
da0f1f59b5a73c4ba9c6a4f280fe4e6ccef7d5c9
-
SHA256
9a5f7ec7f887d02cd09908901bdf584633dc0617830248798fe2af215790b042
-
SHA512
a8267f425b3d810655a9d697697d9c7df8a4631584611cd8902dc0fd2bead7c9bf2f4b62c69145d7a0b3767bca4c1ffd6afc893cdd46c34c6c33c1e3e39b074d
-
SSDEEP
24576:NUnSRjawN2pcLfdknHXqNI2CHWSeQtwnF4H:NUnu2po+2AaQtwnF4H
Score
1/10
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2196 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1616 wrote to memory of 2196 1616 rundll32.exe 28 PID 1616 wrote to memory of 2196 1616 rundll32.exe 28 PID 1616 wrote to memory of 2196 1616 rundll32.exe 28 PID 1616 wrote to memory of 2196 1616 rundll32.exe 28 PID 1616 wrote to memory of 2196 1616 rundll32.exe 28 PID 1616 wrote to memory of 2196 1616 rundll32.exe 28 PID 1616 wrote to memory of 2196 1616 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9a5f7ec7f887d02cd09908901bdf584633dc0617830248798fe2af215790b042.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9a5f7ec7f887d02cd09908901bdf584633dc0617830248798fe2af215790b042.dll,#12⤵
- Suspicious use of SetWindowsHookEx
PID:2196
-