Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
22/09/2023, 04:43
Static task
static1
Behavioral task
behavioral1
Sample
40c80bda2a4986d860e21d3eab9fbbff8e1740d9cc105fc03176f944eefd4a36.dll
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral2
Sample
40c80bda2a4986d860e21d3eab9fbbff8e1740d9cc105fc03176f944eefd4a36.dll
Resource
win10v2004-20230915-en
windows10-2004-x64
General
-
Target
40c80bda2a4986d860e21d3eab9fbbff8e1740d9cc105fc03176f944eefd4a36.dll
-
Size
1.2MB
-
MD5
4cbae76ea5df04c47a30d0dd8e11c7c4
-
SHA1
c7a8127b07585220c12ccd7aea2ac8d34b398f71
-
SHA256
40c80bda2a4986d860e21d3eab9fbbff8e1740d9cc105fc03176f944eefd4a36
-
SHA512
027b5e59fa68bcf4d26a0dc62016e28e6c470de939b5c92f0299fdf98150685db24a7951e79e5034a85def9797f26743ccc4ccb906fadb143139260800357d1b
-
SSDEEP
24576:ElIRTRVAkir0aRUmVT1KI9xHl9T0B99Cj9n99W99qpBHE2G3HjN9297+AxYHvYv1:ECRUr0XY8o5
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 43 IoCs
pid Process 2404 rundll32.exe 2404 rundll32.exe 2404 rundll32.exe 2404 rundll32.exe 2404 rundll32.exe 2404 rundll32.exe 2404 rundll32.exe 2404 rundll32.exe 2404 rundll32.exe 2404 rundll32.exe 2404 rundll32.exe 2404 rundll32.exe 2404 rundll32.exe 2404 rundll32.exe 2404 rundll32.exe 2404 rundll32.exe 2404 rundll32.exe 2404 rundll32.exe 2404 rundll32.exe 2404 rundll32.exe 2404 rundll32.exe 2404 rundll32.exe 2404 rundll32.exe 2404 rundll32.exe 2404 rundll32.exe 2404 rundll32.exe 2404 rundll32.exe 2404 rundll32.exe 2404 rundll32.exe 2404 rundll32.exe 2404 rundll32.exe 2404 rundll32.exe 2404 rundll32.exe 2404 rundll32.exe 2404 rundll32.exe 2404 rundll32.exe 2404 rundll32.exe 2404 rundll32.exe 2404 rundll32.exe 2404 rundll32.exe 2404 rundll32.exe 2404 rundll32.exe 2404 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3020 wrote to memory of 2404 3020 rundll32.exe 28 PID 3020 wrote to memory of 2404 3020 rundll32.exe 28 PID 3020 wrote to memory of 2404 3020 rundll32.exe 28 PID 3020 wrote to memory of 2404 3020 rundll32.exe 28 PID 3020 wrote to memory of 2404 3020 rundll32.exe 28 PID 3020 wrote to memory of 2404 3020 rundll32.exe 28 PID 3020 wrote to memory of 2404 3020 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\40c80bda2a4986d860e21d3eab9fbbff8e1740d9cc105fc03176f944eefd4a36.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\40c80bda2a4986d860e21d3eab9fbbff8e1740d9cc105fc03176f944eefd4a36.dll,#12⤵
- Suspicious use of SetWindowsHookEx
PID:2404
-