Analysis
-
max time kernel
145s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
08-01-2024 15:44
Behavioral task
behavioral1
Sample
4bd3b41d373e85a5478838040fc56f50.dll
Resource
win7-20231129-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
4bd3b41d373e85a5478838040fc56f50.dll
Resource
win10v2004-20231222-en
1 signatures
150 seconds
General
-
Target
4bd3b41d373e85a5478838040fc56f50.dll
-
Size
54KB
-
MD5
4bd3b41d373e85a5478838040fc56f50
-
SHA1
d11b606daf2f2909320afc672797372683c1362e
-
SHA256
c0d7e8fdc01774859e64b3bf827cefa7800391db0b8fe52028ea738182f18ad4
-
SHA512
8f88346f6ee4b706ccddb46e60190d4b29d0318d5d6ae517a61bf4ccb03cb0e77c11f7691d437af12603c75ddcce80202efddabebde17bf96e95e32eb0be072f
-
SSDEEP
1536:81EAiXqlalXCloEQc1g6m6W6xVKV4OQrnP:81EAiXqlalGoEnqCPs4OQj
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1916 wrote to memory of 2476 1916 rundll32.exe rundll32.exe PID 1916 wrote to memory of 2476 1916 rundll32.exe rundll32.exe PID 1916 wrote to memory of 2476 1916 rundll32.exe rundll32.exe
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bd3b41d373e85a5478838040fc56f50.dll,#11⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bd3b41d373e85a5478838040fc56f50.dll,#11⤵
- Suspicious use of WriteProcessMemory