Analysis
-
max time kernel
147s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2024 22:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7f09e34ea4c4dcbe651b306a14c4973dd38c38391d69371f504e5c8ccb5c8282.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
General
-
Target
7f09e34ea4c4dcbe651b306a14c4973dd38c38391d69371f504e5c8ccb5c8282.dll
-
Size
625KB
-
MD5
9d3f2ba9ad7b706b23b58603c301f43b
-
SHA1
6ea6e655b78502ac64326e1e0e747a425759423c
-
SHA256
7f09e34ea4c4dcbe651b306a14c4973dd38c38391d69371f504e5c8ccb5c8282
-
SHA512
94262f5d53b41262b98265156728bc7fb3699f942215239fc6bf87d537d99b79aa4c7abde206debb6e25a004dd904fe46d0cffb3a2179a4bba334062b719eb4a
-
SSDEEP
6144:o6C5AXbMn7UI1FoV2gwTBlrIckPJYYYYYYYYYYYY5:o6RI1Fo/wT3cJYYYYYYYYYYYY5
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3764 wrote to memory of 5068 3764 rundll32.exe 85 PID 3764 wrote to memory of 5068 3764 rundll32.exe 85 PID 3764 wrote to memory of 5068 3764 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7f09e34ea4c4dcbe651b306a14c4973dd38c38391d69371f504e5c8ccb5c8282.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7f09e34ea4c4dcbe651b306a14c4973dd38c38391d69371f504e5c8ccb5c8282.dll,#12⤵PID:5068
-