rundll64[.]exe | Triage

Sharing

General

Target

rundll64.exe
Size

13.6MB
MD5

c012a0d5bcbf9404db18a5bd4d023da2
SHA1

023e94bb24f658c9eb1ebf2c4aa9942d9f85f5e9
SHA256

4b76ffab85b21d682a381fc59026c643b334d68bc46c43499c33da90070bcf47
SHA512

9954733c34d1c413e131b4249304c3eb130ff2e6d7a5cf30cd95fbfab4f1d7d0de0981b5a4c8a22f4a9ba663fcc00ed77a4c046eeae9b1db49fc302a5ffbea4e
SSDEEP

196608:Jw9X+yc8n5dHoIvymwddlIyNDggUgnwRz78MaPVMu0zZiT4RGMijcqJV5ppf18JD:JwAyF5dL5grMzYRPxkKZjD3zilK0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rundll64.exe

Files

rundll64.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 13.6MB - Virtual size: 13.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ