Analysis
-
max time kernel
129s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19-01-2024 00:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
66674d8e53c16d102aad12d2e951fd04.dll
Resource
win7-20231129-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
66674d8e53c16d102aad12d2e951fd04.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
66674d8e53c16d102aad12d2e951fd04.dll
-
Size
241KB
-
MD5
66674d8e53c16d102aad12d2e951fd04
-
SHA1
0197449ca629ebcb82d7e04732491fc5c6e035c1
-
SHA256
883127ce2f8d90f84888bd7664ba68da2de6aac120dca950134b441e834935db
-
SHA512
20b6cf5599d961fec8a4d625be1231318f52f73ddb792911f1d822ebd4e76f815666ee7a18c55d23187e81fc8bdec9c891a369bc333e1a8c661345c7cab44961
-
SSDEEP
6144:mS5ksF0vAoK2bBloThuj8XhXFEP+GXEKRsVnUTV+riqwneu2b:mSRqvAdOotuj8Xh2P+GTeUjq6eu+
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2008-3-0x0000000010000000-0x00000000100A5000-memory.dmp upx behavioral2/memory/2008-2-0x0000000010000000-0x00000000100A5000-memory.dmp upx behavioral2/memory/2008-5-0x0000000010000000-0x00000000100A5000-memory.dmp upx behavioral2/memory/2008-4-0x0000000010000000-0x00000000100A5000-memory.dmp upx -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2008 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2956 wrote to memory of 2008 2956 rundll32.exe 14 PID 2956 wrote to memory of 2008 2956 rundll32.exe 14 PID 2956 wrote to memory of 2008 2956 rundll32.exe 14
Processes
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\66674d8e53c16d102aad12d2e951fd04.dll,#11⤵
- Suspicious use of SetWindowsHookEx
PID:2008
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\66674d8e53c16d102aad12d2e951fd04.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2956