Analysis
-
max time kernel
90s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
05/04/2024, 00:19
Static task
static1
Behavioral task
behavioral1
Sample
b7b347a82e79eecc9f67fc483dfdf1dfef16dea972c9f556d2b73a3c6adc23a8.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b7b347a82e79eecc9f67fc483dfdf1dfef16dea972c9f556d2b73a3c6adc23a8.dll
Resource
win10v2004-20231215-en
General
-
Target
b7b347a82e79eecc9f67fc483dfdf1dfef16dea972c9f556d2b73a3c6adc23a8.dll
-
Size
7KB
-
MD5
65266d95f59cbb42e4d639e28e85d48d
-
SHA1
3de3e4814928ace8a65bd2b1526c6461fba6823e
-
SHA256
b7b347a82e79eecc9f67fc483dfdf1dfef16dea972c9f556d2b73a3c6adc23a8
-
SHA512
2a6abeef015527c90600cb30068a03c205f51e8970abba16be084a19f1a9e1bc1de71dd1c57eb055632155f3cdb5bfe4298f0cc7141fc42632afdf4a759b955f
-
SSDEEP
48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWQbABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPeq3qX5S2hV
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4724 wrote to memory of 4932 4724 rundll32.exe 85 PID 4724 wrote to memory of 4932 4724 rundll32.exe 85 PID 4724 wrote to memory of 4932 4724 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b7b347a82e79eecc9f67fc483dfdf1dfef16dea972c9f556d2b73a3c6adc23a8.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b7b347a82e79eecc9f67fc483dfdf1dfef16dea972c9f556d2b73a3c6adc23a8.dll,#12⤵PID:4932
-