Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
21/12/2023, 22:35
Behavioral task
behavioral1
Sample
1650a931e2facc7c94f905c11d8c41d8.dll
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
1650a931e2facc7c94f905c11d8c41d8.dll
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
1650a931e2facc7c94f905c11d8c41d8.dll
-
Size
751KB
-
MD5
1650a931e2facc7c94f905c11d8c41d8
-
SHA1
5a383d57551dd77a7f3e8aa060e8c651edd76993
-
SHA256
b65360734b097488ac4694f49235db10e0822c002d3330ebcf323f212ac7f198
-
SHA512
99af224466257b41b39b2520c3227cfd109df17c647d17d9d10184c2602bcffcac71d93b86ea3bb2e1f43a53cd6b563e9da7503fa8ae8ec7dc3d2b735993b2de
-
SSDEEP
12288:orTmzUHgoZ4wcY6mN9ELoGd/VVz7V8KEpKIeyqEJtK8UeJixjFNehis3bKy:eIUH0wx6mN9ELH/TF8K2KBydJgPxQ+y
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1896-0-0x0000000000400000-0x00000000005B9000-memory.dmp vmprotect behavioral2/memory/1896-1-0x0000000000400000-0x00000000005B9000-memory.dmp vmprotect behavioral2/memory/1896-2-0x0000000000400000-0x00000000005B9000-memory.dmp vmprotect -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2796 wrote to memory of 1896 2796 rundll32.exe 82 PID 2796 wrote to memory of 1896 2796 rundll32.exe 82 PID 2796 wrote to memory of 1896 2796 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1650a931e2facc7c94f905c11d8c41d8.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1650a931e2facc7c94f905c11d8c41d8.dll,#12⤵PID:1896
-