Analysis
-
max time kernel
140s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
18/09/2023, 06:35
Behavioral task
behavioral1
Sample
37bbbea7f5725e0ed206a0ab3fd32dbd76f56b0db7e13abeb27f7aec877079fa.dll
Resource
win7-20230831-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
37bbbea7f5725e0ed206a0ab3fd32dbd76f56b0db7e13abeb27f7aec877079fa.dll
Resource
win10v2004-20230915-en
2 signatures
150 seconds
General
-
Target
37bbbea7f5725e0ed206a0ab3fd32dbd76f56b0db7e13abeb27f7aec877079fa.dll
-
Size
51KB
-
MD5
b3bdc23bd385f4a6cc26893e645c6960
-
SHA1
2e5b86fe120e0d351e5066857b419e387bbebb95
-
SHA256
37bbbea7f5725e0ed206a0ab3fd32dbd76f56b0db7e13abeb27f7aec877079fa
-
SHA512
78ffa43eb5427384d206435da8be211899e3a47ddc9bf45b53ab01845c0aea164afd927e5753bdb99b35ea768bd56a5008789e7d8cf5efae1dd029b3c8a2ce8f
-
SSDEEP
1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLEJYH5:1dWubF3n9S91BF3fbooJYH5
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 228 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3032 wrote to memory of 228 3032 rundll32.exe 80 PID 3032 wrote to memory of 228 3032 rundll32.exe 80 PID 3032 wrote to memory of 228 3032 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\37bbbea7f5725e0ed206a0ab3fd32dbd76f56b0db7e13abeb27f7aec877079fa.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\37bbbea7f5725e0ed206a0ab3fd32dbd76f56b0db7e13abeb27f7aec877079fa.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:228
-