Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
24/12/2023, 23:28
Behavioral task
behavioral1
Sample
bc256ad0a0fabd10c92dbb9fd869608ea5eed98b168f1e33d56a5e577dd2bd76.dll
Resource
win7-20231129-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
bc256ad0a0fabd10c92dbb9fd869608ea5eed98b168f1e33d56a5e577dd2bd76.dll
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
bc256ad0a0fabd10c92dbb9fd869608ea5eed98b168f1e33d56a5e577dd2bd76.dll
-
Size
899KB
-
MD5
90688437fa72a2dfe9488a39b2ed7c1d
-
SHA1
91fe6143a29c1cdf1c8be73c4a6bbeb123fe6501
-
SHA256
bc256ad0a0fabd10c92dbb9fd869608ea5eed98b168f1e33d56a5e577dd2bd76
-
SHA512
43a737caa80097cf4127f467222dd47f104b4c813833ac0b279b74140f9d0ffe143376518350c66bd3d482f375383b88d2037e341413db41d6b3e1a28b41c5da
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXC:7wqd87VC
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2896 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2540 wrote to memory of 2896 2540 rundll32.exe 16 PID 2540 wrote to memory of 2896 2540 rundll32.exe 16 PID 2540 wrote to memory of 2896 2540 rundll32.exe 16 PID 2540 wrote to memory of 2896 2540 rundll32.exe 16 PID 2540 wrote to memory of 2896 2540 rundll32.exe 16 PID 2540 wrote to memory of 2896 2540 rundll32.exe 16 PID 2540 wrote to memory of 2896 2540 rundll32.exe 16
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bc256ad0a0fabd10c92dbb9fd869608ea5eed98b168f1e33d56a5e577dd2bd76.dll,#11⤵
- Suspicious behavior: RenamesItself
PID:2896
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bc256ad0a0fabd10c92dbb9fd869608ea5eed98b168f1e33d56a5e577dd2bd76.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2540