Analysis
-
max time kernel
147s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31-12-2023 05:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
297682e86b07a21f21ba2fd7a2bcf605.dll
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
297682e86b07a21f21ba2fd7a2bcf605.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
297682e86b07a21f21ba2fd7a2bcf605.dll
-
Size
50KB
-
MD5
297682e86b07a21f21ba2fd7a2bcf605
-
SHA1
bb7da8843bcb45c14d37643c8fa68ac5d0a35a5b
-
SHA256
e74b336b3e4f6c4704f4dafc170c4bb1f603f95577586af29c482c1b76f67e9d
-
SHA512
9dfb644aaefbcc08f6ac71e1dc63e7042fbcab548b666197ca4f05694fc022e5a400b1579879c6a1c80dc00634e34f02f588992e35e49434b985a6143787a72c
-
SSDEEP
768:DrGuiPkGXclalsXsGne3xWU7Laql0plnlc2EN3NbfcVaxWHjCzCi9:D1qmalsXcC1bc2E9NTc+NV
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\pusageki rundll32.exe File opened for modification C:\Windows\SysWOW64\pofaruhu.dll rundll32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2448 rundll32.exe 2448 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2052 wrote to memory of 2448 2052 rundll32.exe 86 PID 2052 wrote to memory of 2448 2052 rundll32.exe 86 PID 2052 wrote to memory of 2448 2052 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\297682e86b07a21f21ba2fd7a2bcf605.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\297682e86b07a21f21ba2fd7a2bcf605.dll,#12⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:2448
-