Analysis
-
max time kernel
142s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
21/12/2023, 22:35
Behavioral task
behavioral1
Sample
1650a931e2facc7c94f905c11d8c41d8.dll
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
1650a931e2facc7c94f905c11d8c41d8.dll
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
1650a931e2facc7c94f905c11d8c41d8.dll
-
Size
751KB
-
MD5
1650a931e2facc7c94f905c11d8c41d8
-
SHA1
5a383d57551dd77a7f3e8aa060e8c651edd76993
-
SHA256
b65360734b097488ac4694f49235db10e0822c002d3330ebcf323f212ac7f198
-
SHA512
99af224466257b41b39b2520c3227cfd109df17c647d17d9d10184c2602bcffcac71d93b86ea3bb2e1f43a53cd6b563e9da7503fa8ae8ec7dc3d2b735993b2de
-
SSDEEP
12288:orTmzUHgoZ4wcY6mN9ELoGd/VVz7V8KEpKIeyqEJtK8UeJixjFNehis3bKy:eIUH0wx6mN9ELH/TF8K2KBydJgPxQ+y
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2224-0-0x0000000001F70000-0x0000000002129000-memory.dmp vmprotect behavioral1/memory/2224-1-0x0000000001F70000-0x0000000002129000-memory.dmp vmprotect behavioral1/memory/2224-2-0x0000000001F70000-0x0000000002129000-memory.dmp vmprotect behavioral1/memory/2224-3-0x0000000001F70000-0x0000000002129000-memory.dmp vmprotect behavioral1/memory/2224-4-0x0000000001F70000-0x0000000002129000-memory.dmp vmprotect behavioral1/memory/2224-5-0x0000000001F70000-0x0000000002129000-memory.dmp vmprotect -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1664 wrote to memory of 2224 1664 rundll32.exe 28 PID 1664 wrote to memory of 2224 1664 rundll32.exe 28 PID 1664 wrote to memory of 2224 1664 rundll32.exe 28 PID 1664 wrote to memory of 2224 1664 rundll32.exe 28 PID 1664 wrote to memory of 2224 1664 rundll32.exe 28 PID 1664 wrote to memory of 2224 1664 rundll32.exe 28 PID 1664 wrote to memory of 2224 1664 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1650a931e2facc7c94f905c11d8c41d8.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1650a931e2facc7c94f905c11d8c41d8.dll,#12⤵PID:2224
-