Analysis
-
max time kernel
139s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
07-11-2023 01:10
Behavioral task
behavioral1
Sample
a63b22e5329d3d40f6dc29ff0c4d0b84122b4b23019997e9377674205a3ed33d.dll
Resource
win7-20231023-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
a63b22e5329d3d40f6dc29ff0c4d0b84122b4b23019997e9377674205a3ed33d.dll
Resource
win10v2004-20231023-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
a63b22e5329d3d40f6dc29ff0c4d0b84122b4b23019997e9377674205a3ed33d.dll
-
Size
899KB
-
MD5
55b17b48b0aeb8b1df0f1db7b878adbc
-
SHA1
456661989c70e2fec4d0d3b16ed8eedec8764a08
-
SHA256
a63b22e5329d3d40f6dc29ff0c4d0b84122b4b23019997e9377674205a3ed33d
-
SHA512
e88de55f781311c2a996fd6d2201355a909cf679b640d6ea19c32aa075c9127ea3df5f6b0ddc0ac33498972dc5cb6b8f2821e800cd2947e55b0040671854123c
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PX1:7wqd87V1
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2408 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2108 wrote to memory of 2408 2108 rundll32.exe 86 PID 2108 wrote to memory of 2408 2108 rundll32.exe 86 PID 2108 wrote to memory of 2408 2108 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a63b22e5329d3d40f6dc29ff0c4d0b84122b4b23019997e9377674205a3ed33d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a63b22e5329d3d40f6dc29ff0c4d0b84122b4b23019997e9377674205a3ed33d.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:2408
-