Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19/01/2024, 05:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
66cabb0e6556afaa8cdc85c2ab184503.dll
Resource
win7-20231215-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
66cabb0e6556afaa8cdc85c2ab184503.dll
Resource
win10v2004-20231215-en
3 signatures
150 seconds
General
-
Target
66cabb0e6556afaa8cdc85c2ab184503.dll
-
Size
230KB
-
MD5
66cabb0e6556afaa8cdc85c2ab184503
-
SHA1
a7aa65e14d2589c396ba5d0bd197bd95ada548bf
-
SHA256
c7684ae0d9c85218305b882f8aa43c76b894729eb3949ffe4615a1c904bad083
-
SHA512
38ad78cdb21d3f4904013f9013c0088ecbe7ded7305253d0e59f6e01c6c425f36e75bf7a0603fa6ce932ff5e69386d48ff98daac09feecb417ed224813068fee
-
SSDEEP
6144:yEuciMnUVXp1cs1YTx/um1S+PlVOuC28i0oOP:ocioeXDz1YTx/um1tVOuCtP
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2700-1-0x0000000010000000-0x00000000100A8000-memory.dmp upx behavioral2/memory/2700-3-0x0000000010000000-0x00000000100A8000-memory.dmp upx behavioral2/memory/2700-5-0x0000000010000000-0x00000000100A8000-memory.dmp upx behavioral2/memory/2700-4-0x0000000010000000-0x00000000100A8000-memory.dmp upx -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2700 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2908 wrote to memory of 2700 2908 rundll32.exe 85 PID 2908 wrote to memory of 2700 2908 rundll32.exe 85 PID 2908 wrote to memory of 2700 2908 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\66cabb0e6556afaa8cdc85c2ab184503.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\66cabb0e6556afaa8cdc85c2ab184503.dll,#12⤵
- Suspicious use of SetWindowsHookEx
PID:2700
-