Analysis
-
max time kernel
152s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 10:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
74751d36c849943a9244125d7050e94e.dll
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
74751d36c849943a9244125d7050e94e.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
74751d36c849943a9244125d7050e94e.dll
-
Size
172KB
-
MD5
74751d36c849943a9244125d7050e94e
-
SHA1
d6e5e910f4c1c9d4693a3822b6169ee3f6934287
-
SHA256
c93e3ebcef2a7cfe6fb8ee28f05920e94ebdce5a9ec331a09b082b76f7faa7ce
-
SHA512
e904c2db5c5b21f10a68aa053fc7e058903f5819b14688995df82e4b4eb2e2d76acd45a7659af5d1b049de3a55e74692cec405043b7a1e854b7741d171addcba
-
SSDEEP
768:t8JG0kjbWUQuoa6yTabjugtuubiJtb8RTbE5/L7rDaL4ZU9QZU96eR:CJGQuZBaDtVCtAG/DaUz
Score
1/10
Malware Config
Signatures
-
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
rundll32.exepid process 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
rundll32.exepid process 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe 1612 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3488 wrote to memory of 1612 3488 rundll32.exe rundll32.exe PID 3488 wrote to memory of 1612 3488 rundll32.exe rundll32.exe PID 3488 wrote to memory of 1612 3488 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74751d36c849943a9244125d7050e94e.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74751d36c849943a9244125d7050e94e.dll,#12⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage