Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 03:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
26fcf4fb4ca60845ff6cfd929d934b93.dll
Resource
win7-20231215-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
26fcf4fb4ca60845ff6cfd929d934b93.dll
Resource
win10v2004-20231222-en
1 signatures
150 seconds
General
-
Target
26fcf4fb4ca60845ff6cfd929d934b93.dll
-
Size
23KB
-
MD5
26fcf4fb4ca60845ff6cfd929d934b93
-
SHA1
7a42619534a1f21497b79987f9842de654092aaa
-
SHA256
2e58ec1e6b23bbbe612258e4f5a7dd256860ffc2e603f32182a3ce82e53d7e64
-
SHA512
5f6c1a5a6e7cabca3b7535c917618c39dfc3ba7e126e6835c1f123d4c23740c8c107c06be2d25245b7cf9be9389fcd2b4f264a1b8f1b4d041fbc9af8bb752e04
-
SSDEEP
384:DiF/TrG/ItgvQHeaqiyy1q4YheN/CxNhxtSrI2GVfleohYb25pZhqquL4BVe:DWW/HgNQ4YheNCRkWDhYa7Zh/Y4Pe
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2012 wrote to memory of 1852 2012 rundll32.exe 16 PID 2012 wrote to memory of 1852 2012 rundll32.exe 16 PID 2012 wrote to memory of 1852 2012 rundll32.exe 16 PID 2012 wrote to memory of 1852 2012 rundll32.exe 16 PID 2012 wrote to memory of 1852 2012 rundll32.exe 16 PID 2012 wrote to memory of 1852 2012 rundll32.exe 16 PID 2012 wrote to memory of 1852 2012 rundll32.exe 16
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\26fcf4fb4ca60845ff6cfd929d934b93.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\26fcf4fb4ca60845ff6cfd929d934b93.dll,#12⤵PID:1852
-