Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06-03-2024 00:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b29b0233fdcf3fd733574505069a3a775dd3fac717a8090f814cf3ad702c1ea1.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
General
-
Target
b29b0233fdcf3fd733574505069a3a775dd3fac717a8090f814cf3ad702c1ea1.dll
-
Size
1.0MB
-
MD5
851ff5589289bb39a007306976088551
-
SHA1
74c81794d373033edd142c35d1f5d3370417db59
-
SHA256
b29b0233fdcf3fd733574505069a3a775dd3fac717a8090f814cf3ad702c1ea1
-
SHA512
27129b7e224ec7ba6a9ac00404dfb8b5869724a0c94dde3f8652224c36395cbb3648ae6d8bfee4672e5d698c50ed393875d01d4509955b9c0c9929be932baa5c
-
SSDEEP
6144:o6C5AXbMn7UI1FoV2gwTBlrIckPJYYYYYYYYYYYY6:o6RI1Fo/wT3cJYYYYYYYYYYYY6
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 2396 wrote to memory of 4172 2396 rundll32.exe rundll32.exe PID 2396 wrote to memory of 4172 2396 rundll32.exe rundll32.exe PID 2396 wrote to memory of 4172 2396 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b29b0233fdcf3fd733574505069a3a775dd3fac717a8090f814cf3ad702c1ea1.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b29b0233fdcf3fd733574505069a3a775dd3fac717a8090f814cf3ad702c1ea1.dll,#12⤵