Analysis
-
max time kernel
118s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11/10/2023, 04:58
Behavioral task
behavioral1
Sample
963ab28f2437c52b6f2c72828013bd0736b0e75bdfe2d0855064e8b2fa5406a9.dll
Resource
win7-20230831-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
963ab28f2437c52b6f2c72828013bd0736b0e75bdfe2d0855064e8b2fa5406a9.dll
Resource
win10v2004-20230915-en
2 signatures
150 seconds
General
-
Target
963ab28f2437c52b6f2c72828013bd0736b0e75bdfe2d0855064e8b2fa5406a9.dll
-
Size
51KB
-
MD5
2ed10c1ff9164692f5315c8f21f4f18b
-
SHA1
5d5909b54ece23c25a686640dded5f38f1153cc6
-
SHA256
963ab28f2437c52b6f2c72828013bd0736b0e75bdfe2d0855064e8b2fa5406a9
-
SHA512
3abcf09aa961a2e260540475870fe3386dc141a9a9a010d1fe836dff725db680ee5c81bec66865bd7722cf87a09c13f5fa2ec7696d5d616a11a29f1d3e421d57
-
SSDEEP
1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLtJYH5:1dWubF3n9S91BF3fboxJYH5
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1688 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1304 wrote to memory of 1688 1304 rundll32.exe 14 PID 1304 wrote to memory of 1688 1304 rundll32.exe 14 PID 1304 wrote to memory of 1688 1304 rundll32.exe 14 PID 1304 wrote to memory of 1688 1304 rundll32.exe 14 PID 1304 wrote to memory of 1688 1304 rundll32.exe 14 PID 1304 wrote to memory of 1688 1304 rundll32.exe 14 PID 1304 wrote to memory of 1688 1304 rundll32.exe 14
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\963ab28f2437c52b6f2c72828013bd0736b0e75bdfe2d0855064e8b2fa5406a9.dll,#11⤵
- Suspicious behavior: RenamesItself
PID:1688
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\963ab28f2437c52b6f2c72828013bd0736b0e75bdfe2d0855064e8b2fa5406a9.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1304