Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08-03-2024 00:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d1b839ff226453091b1e90711b36dd2630a8664432f3742faa1cd24521257c65.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
General
-
Target
d1b839ff226453091b1e90711b36dd2630a8664432f3742faa1cd24521257c65.dll
-
Size
840KB
-
MD5
dc3e5c80671a78e21f1a83ff13260799
-
SHA1
d290a5f07168c4e97cfd11de61f405889ccfe529
-
SHA256
d1b839ff226453091b1e90711b36dd2630a8664432f3742faa1cd24521257c65
-
SHA512
e904b79af7667fbcbe25de1f45c216fdd8f2ec1f449cdfe80c6efe25eb352f7d680f12592634e0d85daf85fa6f0f6afa2085849391e2f99b6678604187b95335
-
SSDEEP
24576:Qe9nfmpSVmL+Cf72yb1SFEtEfPmY4uRD7HpUMhOw8ghE:/BmpSVmLfCDfPJ4cDFPhmghE
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
rundll32.exepid process 2216 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 2184 wrote to memory of 2216 2184 rundll32.exe rundll32.exe PID 2184 wrote to memory of 2216 2184 rundll32.exe rundll32.exe PID 2184 wrote to memory of 2216 2184 rundll32.exe rundll32.exe PID 2184 wrote to memory of 2216 2184 rundll32.exe rundll32.exe PID 2184 wrote to memory of 2216 2184 rundll32.exe rundll32.exe PID 2184 wrote to memory of 2216 2184 rundll32.exe rundll32.exe PID 2184 wrote to memory of 2216 2184 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d1b839ff226453091b1e90711b36dd2630a8664432f3742faa1cd24521257c65.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d1b839ff226453091b1e90711b36dd2630a8664432f3742faa1cd24521257c65.dll,#12⤵
- Suspicious behavior: GetForegroundWindowSpam