Analysis
-
max time kernel
143s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
22/09/2023, 04:43
Static task
static1
Behavioral task
behavioral1
Sample
40c80bda2a4986d860e21d3eab9fbbff8e1740d9cc105fc03176f944eefd4a36.dll
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral2
Sample
40c80bda2a4986d860e21d3eab9fbbff8e1740d9cc105fc03176f944eefd4a36.dll
Resource
win10v2004-20230915-en
windows10-2004-x64
General
-
Target
40c80bda2a4986d860e21d3eab9fbbff8e1740d9cc105fc03176f944eefd4a36.dll
-
Size
1.2MB
-
MD5
4cbae76ea5df04c47a30d0dd8e11c7c4
-
SHA1
c7a8127b07585220c12ccd7aea2ac8d34b398f71
-
SHA256
40c80bda2a4986d860e21d3eab9fbbff8e1740d9cc105fc03176f944eefd4a36
-
SHA512
027b5e59fa68bcf4d26a0dc62016e28e6c470de939b5c92f0299fdf98150685db24a7951e79e5034a85def9797f26743ccc4ccb906fadb143139260800357d1b
-
SSDEEP
24576:ElIRTRVAkir0aRUmVT1KI9xHl9T0B99Cj9n99W99qpBHE2G3HjN9297+AxYHvYv1:ECRUr0XY8o5
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 43 IoCs
pid Process 4424 rundll32.exe 4424 rundll32.exe 4424 rundll32.exe 4424 rundll32.exe 4424 rundll32.exe 4424 rundll32.exe 4424 rundll32.exe 4424 rundll32.exe 4424 rundll32.exe 4424 rundll32.exe 4424 rundll32.exe 4424 rundll32.exe 4424 rundll32.exe 4424 rundll32.exe 4424 rundll32.exe 4424 rundll32.exe 4424 rundll32.exe 4424 rundll32.exe 4424 rundll32.exe 4424 rundll32.exe 4424 rundll32.exe 4424 rundll32.exe 4424 rundll32.exe 4424 rundll32.exe 4424 rundll32.exe 4424 rundll32.exe 4424 rundll32.exe 4424 rundll32.exe 4424 rundll32.exe 4424 rundll32.exe 4424 rundll32.exe 4424 rundll32.exe 4424 rundll32.exe 4424 rundll32.exe 4424 rundll32.exe 4424 rundll32.exe 4424 rundll32.exe 4424 rundll32.exe 4424 rundll32.exe 4424 rundll32.exe 4424 rundll32.exe 4424 rundll32.exe 4424 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1664 wrote to memory of 4424 1664 rundll32.exe 84 PID 1664 wrote to memory of 4424 1664 rundll32.exe 84 PID 1664 wrote to memory of 4424 1664 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\40c80bda2a4986d860e21d3eab9fbbff8e1740d9cc105fc03176f944eefd4a36.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\40c80bda2a4986d860e21d3eab9fbbff8e1740d9cc105fc03176f944eefd4a36.dll,#12⤵
- Suspicious use of SetWindowsHookEx
PID:4424
-