Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
14/02/2024, 00:48
Behavioral task
behavioral1
Sample
9a5a419571b2ccc0ca587d926426bd88.dll
Resource
win7-20231215-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
9a5a419571b2ccc0ca587d926426bd88.dll
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
9a5a419571b2ccc0ca587d926426bd88.dll
-
Size
68KB
-
MD5
9a5a419571b2ccc0ca587d926426bd88
-
SHA1
cb466578bb7679e01838ee66d80e7193207e6061
-
SHA256
4acd027e21969450c8809b921e44161ee27e4c59a3d027e4a098db3ca12c124e
-
SHA512
a4c1674a121de2505c571d2ebfb0c7faff821261b9081153ab8a5e585798e99aa3c8344cb2ed4e4e546772cf92aa13a99b77925f2a43960fa0d0db10e489b9a8
-
SSDEEP
1536:Bm1NGJVGYCGri2IpguUoK0EeNiSNfKXG8IjF88:kX0VBCFpgJ1NeNZf2a88
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1876 wrote to memory of 1400 1876 rundll32.exe 28 PID 1876 wrote to memory of 1400 1876 rundll32.exe 28 PID 1876 wrote to memory of 1400 1876 rundll32.exe 28 PID 1876 wrote to memory of 1400 1876 rundll32.exe 28 PID 1876 wrote to memory of 1400 1876 rundll32.exe 28 PID 1876 wrote to memory of 1400 1876 rundll32.exe 28 PID 1876 wrote to memory of 1400 1876 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9a5a419571b2ccc0ca587d926426bd88.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9a5a419571b2ccc0ca587d926426bd88.dll,#12⤵PID:1400
-