Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14/03/2024, 08:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c8205c7edb79709dcb77038e4af160f2.dll
Resource
win7-20240221-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
c8205c7edb79709dcb77038e4af160f2.dll
Resource
win10v2004-20240226-en
1 signatures
150 seconds
General
-
Target
c8205c7edb79709dcb77038e4af160f2.dll
-
Size
502KB
-
MD5
c8205c7edb79709dcb77038e4af160f2
-
SHA1
c3c935956c0aefc7899e51696829ebbbf5596be6
-
SHA256
515b3103786959194f8dfdcb9abf2c93b84d0977f04b61a084eb73f12d64657c
-
SHA512
ffb30430b27f96332321475b2a4b11d87318ad4ea672ab6854b3194f9aee2a6bb9d0aee7e3cdc54bc3b8c6c2d842193a67bd5c4b900eabc75afd2e02d052fc27
-
SSDEEP
6144:jhlE9IW+WQyKL8ze3iWVGxt5Qr8euxvzj0dmKcAnNkwlMac85yDhJK1wkS5Dqy:FHmP2ZVmQrnuSpcAnNnMIy/1D3
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4868 wrote to memory of 1112 4868 rundll32.exe 89 PID 4868 wrote to memory of 1112 4868 rundll32.exe 89 PID 4868 wrote to memory of 1112 4868 rundll32.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c8205c7edb79709dcb77038e4af160f2.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c8205c7edb79709dcb77038e4af160f2.dll,#12⤵PID:1112
-