Analysis
-
max time kernel
95s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 04:09
Behavioral task
behavioral1
Sample
0489056c3c8e54e960798f644c3330bd.dll
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
0489056c3c8e54e960798f644c3330bd.dll
Resource
win10v2004-20231222-en
2 signatures
150 seconds
General
-
Target
0489056c3c8e54e960798f644c3330bd.dll
-
Size
61KB
-
MD5
0489056c3c8e54e960798f644c3330bd
-
SHA1
2a6c5de2251608ef566d1ba83a6d464d68f785ab
-
SHA256
799b562d069a940c5fca342d56bc8f48b18086f9e8f535c4ec06be33d11894f4
-
SHA512
c3078f8f29dcdc2686aadd026afbb2bd0d64af5de83daae4eb0334e8301760d6c6dec7a07e1abe7c6227000efe51dd1a77032dac24bc9084cf5870b0764ac863
-
SSDEEP
1536:V8O9Nn6RjrinPuQ/4jHosHk4VmVSYyqWIV1W/iNUrjNSLSuWtdq3:2Oz6VWWQKHtRmVSlf1/rrjNptM3
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/744-0-0x0000000010000000-0x000000001000D000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2648 wrote to memory of 744 2648 rundll32.exe 77 PID 2648 wrote to memory of 744 2648 rundll32.exe 77 PID 2648 wrote to memory of 744 2648 rundll32.exe 77
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0489056c3c8e54e960798f644c3330bd.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0489056c3c8e54e960798f644c3330bd.dll,#12⤵PID:744
-