Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
24/01/2024, 01:12
Static task
static1
Behavioral task
behavioral1
Sample
710bfa5de9a75ff9348b921246de35b6.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral2
Sample
710bfa5de9a75ff9348b921246de35b6.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
General
-
Target
710bfa5de9a75ff9348b921246de35b6.dll
-
Size
14KB
-
MD5
710bfa5de9a75ff9348b921246de35b6
-
SHA1
8366ad6f54c8d418344c16f5c02b473b6138e797
-
SHA256
1ef1db19796e8a0362d0ffc41174c9e22dc4d9d08eae23f861928060112ad363
-
SHA512
46dd2b1ba0647859a2344d72131d269700f47da3d84d012469c096e32736863ec30426f6156bfb386adb0cdf8063b71c0cae7e0215390a2ac1a348334eb197aa
-
SSDEEP
192:wesXT6u1u+9hg0GUMnlnZZSo3aPHlZEp1OREPtsr5PG7bGM+LWVfg0rJIu+gsLMv:w5LK0GFlDea1pupa+WVo0uto7kYXD
Malware Config
Signatures
-
Suspicious behavior: LoadsDriver 64 IoCs
pid Process 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2884 wrote to memory of 2952 2884 rundll32.exe 28 PID 2884 wrote to memory of 2952 2884 rundll32.exe 28 PID 2884 wrote to memory of 2952 2884 rundll32.exe 28 PID 2884 wrote to memory of 2952 2884 rundll32.exe 28 PID 2884 wrote to memory of 2952 2884 rundll32.exe 28 PID 2884 wrote to memory of 2952 2884 rundll32.exe 28 PID 2884 wrote to memory of 2952 2884 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\710bfa5de9a75ff9348b921246de35b6.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\710bfa5de9a75ff9348b921246de35b6.dll,#12⤵PID:2952
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5b7eefbae54acadeee92291391459ada4
SHA117ff4ff4b3c5d69a851908ea4e1dfb5246ae2264
SHA2562edb13951dcf0a1417eb55fe5d23c2f35bae779ebef960c3d5d66a238036f8ba
SHA512ed92dbb3ba1d101f7a4489c2a89c0f430ba18c148a1646810c7c4fe6cd2eced382a0351640ab01113a29d4b427e1b105cca5b19b26a8e88ca637c502be65d309
-
Filesize
56B
MD57d2b5bb0c20aff2563a0d5dcd3b5632a
SHA11a4ac79f211b0e42a79d10fc94cfb5bc7dd26c0a
SHA256e0d6a8df5d9342eac8e3f943be9bc44d214fea5a91f4b46ed899196905521443
SHA512159579335fed32f30a519057c4a7b1944523e58769c8467491bbaf9682cb9c0b987520b5bc8c8f19c21d70a3f3cbc44ed9ddaa59a20b4b1229f66d5769f6f89b