Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10-03-2024 06:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bde59384f1c6f45101765f38f29604ac.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
bde59384f1c6f45101765f38f29604ac.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
bde59384f1c6f45101765f38f29604ac.dll
-
Size
140KB
-
MD5
bde59384f1c6f45101765f38f29604ac
-
SHA1
03d0f807363274b35fe8aa0d79c6f08fb5aada64
-
SHA256
6e89d3675b055c9f26b4b88b53af23104b39a587a108921d06f8b5b5a8ba0db4
-
SHA512
eb25c76180bb7e480a9d1817f988c009061daef0490b10735dea7e3e04488d5fa9512ad1832feedaa72b7eac9357840f4eb5c3ff003abd4345acec803d769532
-
SSDEEP
3072:f1+VvJLfTjdh7Z5jR2lALDnRa5cQXYYHO3HYSZeHNa9lq:9cBLbjB5t2lAXnREwEO3HdZ+J
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/232-0-0x0000000001050000-0x000000000105E000-memory.dmp upx behavioral2/memory/232-8-0x0000000001050000-0x000000000105E000-memory.dmp upx behavioral2/memory/232-7-0x0000000001050000-0x000000000105E000-memory.dmp upx behavioral2/memory/232-5-0x0000000001050000-0x000000000105E000-memory.dmp upx behavioral2/memory/232-9-0x0000000001050000-0x000000000105E000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2736 wrote to memory of 232 2736 rundll32.exe 89 PID 2736 wrote to memory of 232 2736 rundll32.exe 89 PID 2736 wrote to memory of 232 2736 rundll32.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bde59384f1c6f45101765f38f29604ac.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bde59384f1c6f45101765f38f29604ac.dll,#12⤵PID:232
-