Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/12/2023, 18:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0b69eb970b5f82c720fb848baa2e36c5.dll
Resource
win7-20231215-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
0b69eb970b5f82c720fb848baa2e36c5.dll
Resource
win10v2004-20231215-en
1 signatures
150 seconds
General
-
Target
0b69eb970b5f82c720fb848baa2e36c5.dll
-
Size
336KB
-
MD5
0b69eb970b5f82c720fb848baa2e36c5
-
SHA1
2a0f771db6657d36a7a961a3b61e07205aede55a
-
SHA256
786670dfdecf3717aaaebe369981b07be81fba5a3f8cf94ec8eb58506cb56896
-
SHA512
727e33583ef74dd2962f69ef67938f3a632fa002d379bc529efbfd60430be49f074be931a34d8d3920ffa7e96340234da32b84ec23205c63b2e9d2e4e7b20281
-
SSDEEP
6144:ndHlHhqnCTXi/w8SfU2fv3c41XXeWmsV245AK:lNnji/xScLCXO431
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2532 wrote to memory of 2272 2532 rundll32.exe 28 PID 2532 wrote to memory of 2272 2532 rundll32.exe 28 PID 2532 wrote to memory of 2272 2532 rundll32.exe 28 PID 2532 wrote to memory of 2272 2532 rundll32.exe 28 PID 2532 wrote to memory of 2272 2532 rundll32.exe 28 PID 2532 wrote to memory of 2272 2532 rundll32.exe 28 PID 2532 wrote to memory of 2272 2532 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0b69eb970b5f82c720fb848baa2e36c5.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0b69eb970b5f82c720fb848baa2e36c5.dll,#12⤵PID:2272
-