Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
11/01/2024, 02:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4f10bca2eeb439da3eb81d6e29e8593c.dll
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
4f10bca2eeb439da3eb81d6e29e8593c.dll
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
4f10bca2eeb439da3eb81d6e29e8593c.dll
-
Size
64KB
-
MD5
4f10bca2eeb439da3eb81d6e29e8593c
-
SHA1
4965a23ccd680ee0d8207a370499bc6333a47250
-
SHA256
1ee2aba5a8d957e2cd36993c195fe1637c6cc041d2c5a1b81a0be4c7f04461cc
-
SHA512
29175792ae154f7ac0ab5dd22c90dba37502a976473e83d61394c644f9fcc1c708552a7058cf6b1fc58015c02a9ca9a3eb715c428feaf8c1ad4d56ba1d9124c8
-
SSDEEP
1536:n8taJXFhYIpq6cALBl0PvaEoqG0ODpG2Jf7DzBIe:nUaJ1hbq6DAPd0WCf7DNIe
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/444-6-0x00000000008D0000-0x00000000008DE000-memory.dmp upx behavioral2/memory/444-4-0x00000000008D0000-0x00000000008DE000-memory.dmp upx behavioral2/memory/444-3-0x00000000008D0000-0x00000000008DE000-memory.dmp upx behavioral2/memory/444-0-0x00000000008D0000-0x00000000008DE000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3540 wrote to memory of 444 3540 rundll32.exe 12 PID 3540 wrote to memory of 444 3540 rundll32.exe 12 PID 3540 wrote to memory of 444 3540 rundll32.exe 12
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4f10bca2eeb439da3eb81d6e29e8593c.dll,#11⤵PID:444
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4f10bca2eeb439da3eb81d6e29e8593c.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3540