Analysis
-
max time kernel
118s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
14/10/2023, 03:39
Behavioral task
behavioral1
Sample
80024218059528e6ce5ef70d64cd643d4b159ab84d3599589969ef45b679e15a.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
80024218059528e6ce5ef70d64cd643d4b159ab84d3599589969ef45b679e15a.dll
Resource
win10v2004-20230915-en
General
-
Target
80024218059528e6ce5ef70d64cd643d4b159ab84d3599589969ef45b679e15a.dll
-
Size
8.7MB
-
MD5
1bf568a152da100ce29d3fb13cf0f6d2
-
SHA1
4ace99ae7a1fa711eff86691dd77783abd86761a
-
SHA256
80024218059528e6ce5ef70d64cd643d4b159ab84d3599589969ef45b679e15a
-
SHA512
80e4f8e51da9398952314f0ce3407e24d746a998c24eacb26ed6f1067a1413a7a0bb2c5563966cd704b8e1a433054e75cf06f748c4c44ed9551feda3c6059998
-
SSDEEP
98304:pnR03PIXOWDUaSuIlH7JPaD2/eklbopO/5owtWk8U8U0POFTeHCYYFt3f0xyVfwA:pRreWDIldi8ypfUz8XOFTIYj3cw5wo9V
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/3048-0-0x0000000010000000-0x00000000108BC000-memory.dmp vmprotect -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2988 wrote to memory of 3048 2988 rundll32.exe 28 PID 2988 wrote to memory of 3048 2988 rundll32.exe 28 PID 2988 wrote to memory of 3048 2988 rundll32.exe 28 PID 2988 wrote to memory of 3048 2988 rundll32.exe 28 PID 2988 wrote to memory of 3048 2988 rundll32.exe 28 PID 2988 wrote to memory of 3048 2988 rundll32.exe 28 PID 2988 wrote to memory of 3048 2988 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\80024218059528e6ce5ef70d64cd643d4b159ab84d3599589969ef45b679e15a.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\80024218059528e6ce5ef70d64cd643d4b159ab84d3599589969ef45b679e15a.dll,#12⤵PID:3048
-