Analysis
-
max time kernel
129s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 16:17
Static task
static1
Behavioral task
behavioral1
Sample
74f37c08eeb5cdf977b9d66b34b9e996.dll
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
General
-
Target
74f37c08eeb5cdf977b9d66b34b9e996.dll
-
Size
257KB
-
MD5
74f37c08eeb5cdf977b9d66b34b9e996
-
SHA1
c056dd881e23dd4b65f3cbafcff9852a9ea5d910
-
SHA256
7cf86bd996e247f1b016564911dcf1b219149a77c20c3fe2f9cc48f769bf724a
-
SHA512
fa6c961c965f0a636c799629bb49b7c69151c632b4d222c6b017c98070292ad83d38a23f724e33bf89bd9e8804207908bf6c5f65b2f7fc013875353bea769df8
-
SSDEEP
3072:quu7FbSfY0MFnBHRp8duMvdeRsX0+FCfc1pfk:mb4QBH0gMvdeRkAt
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 932 wrote to memory of 452 932 rundll32.exe rundll32.exe PID 932 wrote to memory of 452 932 rundll32.exe rundll32.exe PID 932 wrote to memory of 452 932 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f37c08eeb5cdf977b9d66b34b9e996.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\74f37c08eeb5cdf977b9d66b34b9e996.dll,#12⤵PID:452