Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
04/04/2024, 22:16
Static task
static1
Behavioral task
behavioral1
Sample
7ba08553870c18d017b09122bd419c872806962387aaea0d0179f88debcdea82.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7ba08553870c18d017b09122bd419c872806962387aaea0d0179f88debcdea82.dll
Resource
win10v2004-20240226-en
General
-
Target
7ba08553870c18d017b09122bd419c872806962387aaea0d0179f88debcdea82.dll
-
Size
6KB
-
MD5
bbef0609c2a172e19964dab9aaae28f8
-
SHA1
881a74b4959d2ab741af528e8f302e1e8b49dde3
-
SHA256
7ba08553870c18d017b09122bd419c872806962387aaea0d0179f88debcdea82
-
SHA512
10b2da4fce0729a559985fc11cbf22d5c11c9e03fefb59f69c2a438341a00433ad91f0d15c45522e41df7bad863a7b917474d1ef28dd697d0f796cfa327adbaa
-
SSDEEP
48:6AA35YVOQDV8FszwydlAYsLFV3G0qH2B+BDq9J5S2:0QDV8FscMjsLFV3O2B+FqX5S2
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5116 wrote to memory of 1632 5116 rundll32.exe 85 PID 5116 wrote to memory of 1632 5116 rundll32.exe 85 PID 5116 wrote to memory of 1632 5116 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7ba08553870c18d017b09122bd419c872806962387aaea0d0179f88debcdea82.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7ba08553870c18d017b09122bd419c872806962387aaea0d0179f88debcdea82.dll,#12⤵PID:1632
-