Analysis
- max time kernel
145s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system - submitted
25/01/2024, 17:49
Behavioral task
behavioral1
Sample
7522508cab7b9fa7d8c9de6a7168c1bf.dll
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
General
- Target 7522508cab7b9fa7d8c9de6a7168c1bf.dll
- Size 564KB
- Sample240125-wecf4acag4
- SHA256 97c601c1490ba6f1fb1d90f0f6305d56a694417438a2b00ee38863409b9404ac
- MD5 7522508cab7b9fa7d8c9de6a7168c1bf
- SHA1 6760f675d99a1683b463476e1d65b0bdd82d31b0
- SHA512 bf58eb9ff593320d0f6b346e3cb050a5553097e03064c433d148368c4b6968bc66943fd154b6975a1e3a6778c332869e196151917df641e394318bfbcfbf2af8
- SSDEEP 6144:lsdWO07nul6GDkYdWsh+zLy9ZJPLkSycIC7SFgc4955AubmYwpRqeq8cbsxshld8:am9roQWoiSmcIfbmFpl2bVzhA8X3F
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3368-0-0x0000000010000000-0x000000001019E000-memory.dmp vmprotect behavioral2/memory/3368-1-0x0000000010000000-0x000000001019E000-memory.dmp vmprotect behavioral2/memory/3368-2-0x0000000010000000-0x000000001019E000-memory.dmp vmprotect - Suspicious use of SetWindowsHookEx 44 IoCs
pid Process 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe 3368 rundll32.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4692 wrote to memory of 3368 4692 rundll32.exe 84 PID 4692 wrote to memory of 3368 4692 rundll32.exe 84 PID 4692 wrote to memory of 3368 4692 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7522508cab7b9fa7d8c9de6a7168c1bf.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7522508cab7b9fa7d8c9de6a7168c1bf.dll,#12⤵
- Suspicious use of SetWindowsHookEx
PID:3368
-