Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19/03/2024, 01:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d4debcb65074d62b7f8417e0bad63e37.dll
Resource
win7-20240221-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
d4debcb65074d62b7f8417e0bad63e37.dll
Resource
win10v2004-20240226-en
1 signatures
150 seconds
General
-
Target
d4debcb65074d62b7f8417e0bad63e37.dll
-
Size
80KB
-
MD5
d4debcb65074d62b7f8417e0bad63e37
-
SHA1
5ca1084412487d08ddf4579f41ef3de2185d1da1
-
SHA256
590dce132dad986fb236f88958a7c2b4d621428992519f4760846aed7dd05dff
-
SHA512
ab8b1425d0d469cea827d4fc73f320b7b344e3b0ef3d04b29354654e2f5daf46c25bd6cc1b3ba826b44c956fe94719d881073a63a6494779209c0d0e62b960f5
-
SSDEEP
384:HWtHvCXI+egJlq7/h9swEi80LbqQvszkpNRwYyGCiA3L0f4D:HoHvCXI+eGlq7/XgiRbq9YNRwlGk70f6
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1968 wrote to memory of 2220 1968 rundll32.exe 28 PID 1968 wrote to memory of 2220 1968 rundll32.exe 28 PID 1968 wrote to memory of 2220 1968 rundll32.exe 28 PID 1968 wrote to memory of 2220 1968 rundll32.exe 28 PID 1968 wrote to memory of 2220 1968 rundll32.exe 28 PID 1968 wrote to memory of 2220 1968 rundll32.exe 28 PID 1968 wrote to memory of 2220 1968 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d4debcb65074d62b7f8417e0bad63e37.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d4debcb65074d62b7f8417e0bad63e37.dll,#12⤵PID:2220
-