Analysis
-
max time kernel
148s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2023 06:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0c27f976c8b9f2bee75d59ff6bb812a6.dll
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
0c27f976c8b9f2bee75d59ff6bb812a6.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
0c27f976c8b9f2bee75d59ff6bb812a6.dll
-
Size
79KB
-
MD5
0c27f976c8b9f2bee75d59ff6bb812a6
-
SHA1
2642f05a65a082b4b3fd7c0b29184949a99ff9b8
-
SHA256
50f40e140e2851d818d6b5695d3cde6fe522ace365034ffb3bd8937405b18605
-
SHA512
daa05e360a9ea408db4b5411ec09742bf873f69fb1199a7cb1c9f9d7f70cff603371f352d9423ba90c21d90743079669c33e2a2814c76187c5edc59867b14880
-
SSDEEP
1536:wuHoRJlJbT8eox2Icm+cHoI6bUjC8ckM7mRq7lvyU5Bf4pv1/mtTfL:w5J7q2IKY64jtcD7con7f4yhL
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe 840 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4852 wrote to memory of 840 4852 rundll32.exe 16 PID 4852 wrote to memory of 840 4852 rundll32.exe 16 PID 4852 wrote to memory of 840 4852 rundll32.exe 16
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c27f976c8b9f2bee75d59ff6bb812a6.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
PID:840
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c27f976c8b9f2bee75d59ff6bb812a6.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4852