Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 14:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1ad29c89e7a8d1d4397b7e119b68ae79.dll
Resource
win7-20231215-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
1ad29c89e7a8d1d4397b7e119b68ae79.dll
Resource
win10v2004-20231222-en
1 signatures
150 seconds
General
-
Target
1ad29c89e7a8d1d4397b7e119b68ae79.dll
-
Size
26KB
-
MD5
1ad29c89e7a8d1d4397b7e119b68ae79
-
SHA1
908d9d0ebc133bc70def8eac789c08f5b0d8cd53
-
SHA256
f03c548ae7e850b021df27da28e51ce92f325dc90e87f34cbbaeac302fc4edce
-
SHA512
0c08a0b81b92d0f2dd338578b1c6f10a90526c27c5320f80d429880c6dfcab516f9f7aa60f69d4854b35f7d9cbd8e1e5d2d7dfdc096b49e7f5aafb1f5f5b300e
-
SSDEEP
768:d/RNBl/ija+1Ijff/d7kwktQ6UonoJsvQYwBTrlP+:dZN7Xd7K9TQbprlP+
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2676 wrote to memory of 2468 2676 rundll32.exe 28 PID 2676 wrote to memory of 2468 2676 rundll32.exe 28 PID 2676 wrote to memory of 2468 2676 rundll32.exe 28 PID 2676 wrote to memory of 2468 2676 rundll32.exe 28 PID 2676 wrote to memory of 2468 2676 rundll32.exe 28 PID 2676 wrote to memory of 2468 2676 rundll32.exe 28 PID 2676 wrote to memory of 2468 2676 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1ad29c89e7a8d1d4397b7e119b68ae79.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1ad29c89e7a8d1d4397b7e119b68ae79.dll,#12⤵PID:2468
-