Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24/12/2023, 18:28
Behavioral task
behavioral1
Sample
0bdd59b3fdad89b2187d5cda30c62e01.dll
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
0bdd59b3fdad89b2187d5cda30c62e01.dll
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
0bdd59b3fdad89b2187d5cda30c62e01.dll
-
Size
12KB
-
MD5
0bdd59b3fdad89b2187d5cda30c62e01
-
SHA1
5347e4df50356b48eaee0212a3ca7dcc2102e3d6
-
SHA256
863f6255cf7fcf235c8eedacbbc7b4746853e08aa79f2a0b126925ede94e1a88
-
SHA512
3ebcb9a048e3680668dd4f81d7808623111ef78dcf89316ab0904c620004ee6ffdc2eeca724ab46eae4c34bf52595783132b2ed685710e4c43579946f5f3bc26
-
SSDEEP
192:yvQqQLVXh8gaFLKlcMsDBe4dGTLlPG4pdAaTXdjjBxXp4eh6JhU89zvE4:yvaVmzFLNDDBe9TLlb7Xdjjrns+8tv
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4980-0-0x0000000010000000-0x000000001000F000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4512 wrote to memory of 4980 4512 rundll32.exe 14 PID 4512 wrote to memory of 4980 4512 rundll32.exe 14 PID 4512 wrote to memory of 4980 4512 rundll32.exe 14
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0bdd59b3fdad89b2187d5cda30c62e01.dll,#11⤵PID:4980
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0bdd59b3fdad89b2187d5cda30c62e01.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4512