Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 11:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6a8deaa83c224b7299c99d530f1604c6.dll
Resource
win7-20231215-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
6a8deaa83c224b7299c99d530f1604c6.dll
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
6a8deaa83c224b7299c99d530f1604c6.dll
-
Size
2KB
-
MD5
6a8deaa83c224b7299c99d530f1604c6
-
SHA1
ee3c3127c512f26ad8ea1b9e5692a4950d5801ec
-
SHA256
e3d9fdac40f5faf41773d80cb88775ef9574b53f3019c57c2d8d63ee16fa49c6
-
SHA512
ce2e250cffcfaa749f66ab43278fff2242f55ff66e6893b14dfe916edb52f2157eefa53e2de5e93b97ecf5683b2ebe60ce45c192c175725d891fa5aea4f6263b
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1768 wrote to memory of 2392 1768 rundll32.exe 28 PID 1768 wrote to memory of 2392 1768 rundll32.exe 28 PID 1768 wrote to memory of 2392 1768 rundll32.exe 28 PID 1768 wrote to memory of 2392 1768 rundll32.exe 28 PID 1768 wrote to memory of 2392 1768 rundll32.exe 28 PID 1768 wrote to memory of 2392 1768 rundll32.exe 28 PID 1768 wrote to memory of 2392 1768 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6a8deaa83c224b7299c99d530f1604c6.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6a8deaa83c224b7299c99d530f1604c6.dll,#12⤵PID:2392
-