Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
28/12/2023, 20:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f60c17044b65289b11461ce3db442582.dll
Resource
win7-20231129-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
f60c17044b65289b11461ce3db442582.dll
Resource
win10v2004-20231215-en
1 signatures
150 seconds
General
-
Target
f60c17044b65289b11461ce3db442582.dll
-
Size
33KB
-
MD5
f60c17044b65289b11461ce3db442582
-
SHA1
844f96d1a2be48d3c2b35b5eb98b9becf367f1d0
-
SHA256
70234b4e936fbcbbd31557472a37953f300ff3d4ed1ea5d8a3759aa27cec3fc6
-
SHA512
1e9432e116b5e215506c558d03bb6d1815bf76490b28c218393997b5a36122df0710b2ad742d5d3d928f561e4248d3f7d7d3aacd87a78c35808b643ad1583e1d
-
SSDEEP
768:R5SiPcjVLML2JEgaed9/77TrKftta4SqO8D7R8dC5:RYBjHhaeH7TrKf5pRE8
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3048 wrote to memory of 3052 3048 rundll32.exe 14 PID 3048 wrote to memory of 3052 3048 rundll32.exe 14 PID 3048 wrote to memory of 3052 3048 rundll32.exe 14 PID 3048 wrote to memory of 3052 3048 rundll32.exe 14 PID 3048 wrote to memory of 3052 3048 rundll32.exe 14 PID 3048 wrote to memory of 3052 3048 rundll32.exe 14 PID 3048 wrote to memory of 3052 3048 rundll32.exe 14
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f60c17044b65289b11461ce3db442582.dll,#11⤵PID:3052
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f60c17044b65289b11461ce3db442582.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3048