Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-02-2024 07:23
Static task
static1
Behavioral task
behavioral1
Sample
CoreUIComponent.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
CoreUIComponent.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
essential.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
essential.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
secur32.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
secur32.dll
Resource
win10v2004-20240226-en
General
-
Target
secur32.dll
-
Size
54KB
-
MD5
f58e0dfb8f915fa5ce1b7ca50c46b51b
-
SHA1
9acb977f13fce7ec38275887ddbbc0f42532e907
-
SHA256
90fa29cc98be1d715df26d22079bdb8ce1d1fd3ce6a4efb39a4c192134e01020
-
SHA512
4ebab09c4319c4604e7dad00f669e572ecf79d9db74a1a6f6ad833ea4be2ce3ead1548196a9b15a052ad006af28afa2005bd5523b8215e1f51fce9671a73580d
-
SSDEEP
768:rC8sPHjgxRIO5h7Ji10Ed4WKn84n2ZePq+RTdFvnM+cmVqDj64Bj:ri/Mf7oiEdXKn84n2ad/vbcmVWjXBj
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1220 wrote to memory of 2780 1220 rundll32.exe rundll32.exe PID 1220 wrote to memory of 2780 1220 rundll32.exe rundll32.exe PID 1220 wrote to memory of 2780 1220 rundll32.exe rundll32.exe PID 1220 wrote to memory of 2780 1220 rundll32.exe rundll32.exe PID 1220 wrote to memory of 2780 1220 rundll32.exe rundll32.exe PID 1220 wrote to memory of 2780 1220 rundll32.exe rundll32.exe PID 1220 wrote to memory of 2780 1220 rundll32.exe rundll32.exe