Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
24/02/2024, 18:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a26ccf39a72e3e26b6700557a7f6b831.dll
Resource
win7-20240220-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
a26ccf39a72e3e26b6700557a7f6b831.dll
Resource
win10v2004-20240221-en
1 signatures
150 seconds
General
-
Target
a26ccf39a72e3e26b6700557a7f6b831.dll
-
Size
112KB
-
MD5
a26ccf39a72e3e26b6700557a7f6b831
-
SHA1
85192ea4b74eee7e93b5462f0c2711737f0dd528
-
SHA256
68f03d25eaccbf4ba1a14d5087478093a14032364f6a317e9ace6dc2fc4324ea
-
SHA512
5566c556c8df1fad6ab2cfe6b26155b9597f73050f2717c8209aa97181b02edb05a471b0e27b924caaf7a85453392c79578124406fb80f595775f3d3592780c7
-
SSDEEP
1536:8ZTCWDsDTuAA0JCQqkGq85DYHG7/HCZs82IooqaJGM8KCPK:8ZTDsj5gQqZA8K6oqaJIKCi
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1972 wrote to memory of 1800 1972 rundll32.exe 28 PID 1972 wrote to memory of 1800 1972 rundll32.exe 28 PID 1972 wrote to memory of 1800 1972 rundll32.exe 28 PID 1972 wrote to memory of 1800 1972 rundll32.exe 28 PID 1972 wrote to memory of 1800 1972 rundll32.exe 28 PID 1972 wrote to memory of 1800 1972 rundll32.exe 28 PID 1972 wrote to memory of 1800 1972 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a26ccf39a72e3e26b6700557a7f6b831.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a26ccf39a72e3e26b6700557a7f6b831.dll,#12⤵PID:1800
-