Analysis
-
max time kernel
118s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 03:48
Behavioral task
behavioral1
Sample
0d6d8c92239de95ce61a0e0ac5dcf1dc.dll
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
0d6d8c92239de95ce61a0e0ac5dcf1dc.dll
Resource
win10v2004-20231222-en
2 signatures
150 seconds
General
-
Target
0d6d8c92239de95ce61a0e0ac5dcf1dc.dll
-
Size
95KB
-
MD5
0d6d8c92239de95ce61a0e0ac5dcf1dc
-
SHA1
7f617845aee5eabfa2a48c48c79bf359b51edfea
-
SHA256
253c4ba6298bcea804d91dd83d285816de8d6811dc2af156e4970bd396fedde4
-
SHA512
e41af947ebce4140e1c6a6426ee4ee403e3db572c3e783f97a66b68746876b1ac4d6e05a067a8cffe6d4c7d955fc7df9205b8aee9b58106b1d51a463bfc58601
-
SSDEEP
1536:vPFJHJpkUPDVSModHGS/bcbHFfB18wdvrsKFEMAkwOx:3FOQDVS9H9/bUH9B18wrsKFEMArOx
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2196 1180 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2016 wrote to memory of 1180 2016 rundll32.exe 28 PID 2016 wrote to memory of 1180 2016 rundll32.exe 28 PID 2016 wrote to memory of 1180 2016 rundll32.exe 28 PID 2016 wrote to memory of 1180 2016 rundll32.exe 28 PID 2016 wrote to memory of 1180 2016 rundll32.exe 28 PID 2016 wrote to memory of 1180 2016 rundll32.exe 28 PID 2016 wrote to memory of 1180 2016 rundll32.exe 28 PID 1180 wrote to memory of 2196 1180 rundll32.exe 29 PID 1180 wrote to memory of 2196 1180 rundll32.exe 29 PID 1180 wrote to memory of 2196 1180 rundll32.exe 29 PID 1180 wrote to memory of 2196 1180 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0d6d8c92239de95ce61a0e0ac5dcf1dc.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0d6d8c92239de95ce61a0e0ac5dcf1dc.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1180 -s 2603⤵
- Program crash
PID:2196
-
-