Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
09/10/2023, 01:21
Behavioral task
behavioral1
Sample
6556736c638a07e331272a8cc8177a38848d6fb5e9168e3408b9bfddabd985b5.dll
Resource
win7-20230831-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
6556736c638a07e331272a8cc8177a38848d6fb5e9168e3408b9bfddabd985b5.dll
Resource
win10v2004-20230915-en
2 signatures
150 seconds
General
-
Target
6556736c638a07e331272a8cc8177a38848d6fb5e9168e3408b9bfddabd985b5.dll
-
Size
899KB
-
MD5
230b2a34069d73e08c71dfc121ef6a1f
-
SHA1
4452d715fc666b6c532191554e6e9ccb7593bc51
-
SHA256
6556736c638a07e331272a8cc8177a38848d6fb5e9168e3408b9bfddabd985b5
-
SHA512
ab830d31d45367f0f493824f60b5427da68e2d90e4125c03a3f261a79bb2c81a6e10280c3c3f1ecfc396be17b44117f88efe5a4dfe5370a9b703da12669998b0
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXC:7wqd87VC
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4076 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4840 wrote to memory of 4076 4840 rundll32.exe 85 PID 4840 wrote to memory of 4076 4840 rundll32.exe 85 PID 4840 wrote to memory of 4076 4840 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6556736c638a07e331272a8cc8177a38848d6fb5e9168e3408b9bfddabd985b5.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6556736c638a07e331272a8cc8177a38848d6fb5e9168e3408b9bfddabd985b5.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:4076
-