Analysis
-
max time kernel
141s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 08:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6101f3b66dc1b58f8f18faedca0a1117.dll
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
6101f3b66dc1b58f8f18faedca0a1117.dll
Resource
win10v2004-20231215-en
3 signatures
150 seconds
General
-
Target
6101f3b66dc1b58f8f18faedca0a1117.dll
-
Size
69KB
-
MD5
6101f3b66dc1b58f8f18faedca0a1117
-
SHA1
f64f7c19031dbd6f04c6fb9f7a0fd41f2d8a560d
-
SHA256
7282511813c4f941717ac9f7e22dea59354d7a5659721664623bbfa9407bb549
-
SHA512
aee18fd4c9cf11518d77a37126859c92cb280f15f58700ac27e712bccaddbc925203b3f667b09eb7aad187137610df0c426430a119cf6f6017b71d83ad2df305
-
SSDEEP
1536:KKm1vNA98nvjYRCKJF+JaXPpNqWh2T1aIZpMTnAAzqRbitDllHwztuQ:KKAxnFK6wXxNqWUT1HMTnSQtRlHwz7
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\vufilire.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\yizorowa rundll32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3896 rundll32.exe 3896 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2464 wrote to memory of 3896 2464 rundll32.exe 14 PID 2464 wrote to memory of 3896 2464 rundll32.exe 14 PID 2464 wrote to memory of 3896 2464 rundll32.exe 14
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6101f3b66dc1b58f8f18faedca0a1117.dll,#11⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:3896
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6101f3b66dc1b58f8f18faedca0a1117.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2464