Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
13-11-2023 16:14
Behavioral task
behavioral1
Sample
0705ca847957e5138d7c88fcfcb5123d20b7a75c234ab6be19582f441b0f189e.dll
Resource
win7-20231020-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
0705ca847957e5138d7c88fcfcb5123d20b7a75c234ab6be19582f441b0f189e.dll
Resource
win10v2004-20231023-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
0705ca847957e5138d7c88fcfcb5123d20b7a75c234ab6be19582f441b0f189e.dll
-
Size
899KB
-
MD5
b993f16e59d189d1b9e324c924efef4e
-
SHA1
6b4dac5ec408f235a2e2e2b1c1efefe94b09a144
-
SHA256
0705ca847957e5138d7c88fcfcb5123d20b7a75c234ab6be19582f441b0f189e
-
SHA512
d83115530940d6454f4e61b74e156fa2f3e123f4910ad24eab3ef4762b6b9bf632a89b939fe4f15f04ce10a25d88478da52f1b251d67bee168231b9cc6a42e8d
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXx:7wqd87Vx
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 552 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5008 wrote to memory of 552 5008 rundll32.exe 86 PID 5008 wrote to memory of 552 5008 rundll32.exe 86 PID 5008 wrote to memory of 552 5008 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0705ca847957e5138d7c88fcfcb5123d20b7a75c234ab6be19582f441b0f189e.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0705ca847957e5138d7c88fcfcb5123d20b7a75c234ab6be19582f441b0f189e.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:552
-