Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
06-01-2024 13:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
465b61e26e38affa77567869a355e685.dll
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
465b61e26e38affa77567869a355e685.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
465b61e26e38affa77567869a355e685.dll
-
Size
406KB
-
MD5
465b61e26e38affa77567869a355e685
-
SHA1
acc584e781338754bbf45e3cbf2d1ac5bfd422b7
-
SHA256
31e0fd72a8250387d7e8034017047647147e8a8c2f6df73621d88b9152e69cde
-
SHA512
99b16e2ab1668cd1404470033cf1e734f19124d1ca5b72e7fa501803ebd0123a67a05e490d2c6e6f1767ddaa38c0656eec197287e01c8a77b383a748d68a99b3
-
SSDEEP
12288:mcqjXM52gpI8NAuM3GxekEDSRemUgn/8O1Hi:m3Y52eI8NAu6GxekED0UUVV
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2292 wrote to memory of 2744 2292 rundll32.exe 14 PID 2292 wrote to memory of 2744 2292 rundll32.exe 14 PID 2292 wrote to memory of 2744 2292 rundll32.exe 14
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\465b61e26e38affa77567869a355e685.dll,#11⤵PID:2744
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\465b61e26e38affa77567869a355e685.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2292