Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
21-09-2023 03:50
Static task
static1
Behavioral task
behavioral1
Sample
923b6961d732996a1ee75352402cdc103d41e3acca9757393b698231784cccbb.dll
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral2
Sample
923b6961d732996a1ee75352402cdc103d41e3acca9757393b698231784cccbb.dll
Resource
win10v2004-20230915-en
windows10-2004-x64
General
-
Target
923b6961d732996a1ee75352402cdc103d41e3acca9757393b698231784cccbb.dll
-
Size
12.9MB
-
MD5
a3c4c882a08fb69686cdf9be7d583ae9
-
SHA1
10ed0f126472b2eff6d26b28bf27470c665f818f
-
SHA256
923b6961d732996a1ee75352402cdc103d41e3acca9757393b698231784cccbb
-
SHA512
aafd278f5857113e94700bbdacd786add4165c983792306ab88235276dcd44d110891fcaba7e6c9920929f7fdd96b7c14c6e74f2edba105f8c4929b64da60037
-
SSDEEP
196608:Yg84lEmsZrhaEFlXcUtOy+FFZeDjQe0lbcMD/tK++:Y3GsZrjlX36FHgjQjK++
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 60 IoCs
pid Process 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe 2032 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1436 wrote to memory of 2032 1436 rundll32.exe 28 PID 1436 wrote to memory of 2032 1436 rundll32.exe 28 PID 1436 wrote to memory of 2032 1436 rundll32.exe 28 PID 1436 wrote to memory of 2032 1436 rundll32.exe 28 PID 1436 wrote to memory of 2032 1436 rundll32.exe 28 PID 1436 wrote to memory of 2032 1436 rundll32.exe 28 PID 1436 wrote to memory of 2032 1436 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\923b6961d732996a1ee75352402cdc103d41e3acca9757393b698231784cccbb.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\923b6961d732996a1ee75352402cdc103d41e3acca9757393b698231784cccbb.dll,#12⤵
- Suspicious use of SetWindowsHookEx
PID:2032
-