Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2023, 23:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
06cc02cd4727debe42329c711e4b6a74.dll
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
06cc02cd4727debe42329c711e4b6a74.dll
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
06cc02cd4727debe42329c711e4b6a74.dll
-
Size
66KB
-
MD5
06cc02cd4727debe42329c711e4b6a74
-
SHA1
80ee805d514aa188f99c1ca32263f1fe69569571
-
SHA256
e3cb9552a28361403491e0a7bfac661d7b492c3f5e53b4d84184a3b762f27c80
-
SHA512
a33ff638e4cb497cf029ae81057675255f81079beea9cdda27d17320603ddf43ed03cba97816e8a1a240870023ad80cdcf7978fc754b5ea2910b8c1bc698ccb0
-
SSDEEP
1536:wipXkmK11Q0IL91dKiE3OFnmGO3UVyoYDJDBz:m11QrZueJ8UAJDBz
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/764-0-0x00000000023D0000-0x00000000023DE000-memory.dmp upx behavioral2/memory/764-3-0x00000000023D0000-0x00000000023DE000-memory.dmp upx behavioral2/memory/764-4-0x00000000023D0000-0x00000000023DE000-memory.dmp upx behavioral2/memory/764-7-0x00000000023D0000-0x00000000023DE000-memory.dmp upx behavioral2/memory/764-6-0x00000000023D0000-0x00000000023DE000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1424 wrote to memory of 764 1424 rundll32.exe 34 PID 1424 wrote to memory of 764 1424 rundll32.exe 34 PID 1424 wrote to memory of 764 1424 rundll32.exe 34
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\06cc02cd4727debe42329c711e4b6a74.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\06cc02cd4727debe42329c711e4b6a74.dll,#12⤵PID:764
-