Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
07/01/2024, 13:44
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
4921eaa712f340b0a9ab3344505388c9.dll
Resource
win7-20231215-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
4921eaa712f340b0a9ab3344505388c9.dll
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
4921eaa712f340b0a9ab3344505388c9.dll
-
Size
241KB
-
MD5
4921eaa712f340b0a9ab3344505388c9
-
SHA1
4539cc7c8369475e22e181b778ee141ffeb4e3e9
-
SHA256
aa912b656aeb0bfddea1e01d68fb040c90ca01232c5a0650b73f6ae615377f74
-
SHA512
bd2180721cf66f34165d667e7f455349163d0b7d0db09dafb67f0232c4861239b63048c1d05d30153fd3742c5a17a7dfe6059b5b5290d97fd31b0fb0cb02c7d9
-
SSDEEP
6144:oqTrecAn327nq5Ka+WmbV7I+Caq7HMCtJXPpg:oqeDGO5KmmJ9bkMCtJXRg
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 836 wrote to memory of 2188 836 rundll32.exe 28 PID 836 wrote to memory of 2188 836 rundll32.exe 28 PID 836 wrote to memory of 2188 836 rundll32.exe 28 PID 836 wrote to memory of 2188 836 rundll32.exe 28 PID 836 wrote to memory of 2188 836 rundll32.exe 28 PID 836 wrote to memory of 2188 836 rundll32.exe 28 PID 836 wrote to memory of 2188 836 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4921eaa712f340b0a9ab3344505388c9.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4921eaa712f340b0a9ab3344505388c9.dll,#12⤵PID:2188
-