Analysis
-
max time kernel
92s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05-04-2024 13:59
Static task
static1
Behavioral task
behavioral1
Sample
2159f145ac1262f8afe5c1c9f5b3377386bd65632aff191be5c06e374e046ec7.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2159f145ac1262f8afe5c1c9f5b3377386bd65632aff191be5c06e374e046ec7.dll
Resource
win10v2004-20240226-en
General
-
Target
2159f145ac1262f8afe5c1c9f5b3377386bd65632aff191be5c06e374e046ec7.dll
-
Size
4.9MB
-
MD5
124637e805ed5551da82b658e79ebf28
-
SHA1
755f696f8be7cded195c2e90f40bf17d26c76554
-
SHA256
2159f145ac1262f8afe5c1c9f5b3377386bd65632aff191be5c06e374e046ec7
-
SHA512
9d763b01ebffd7e63494b5aa33e3b8a9c10b8bd833449c67ab035e9d1c25281dde295037d8e1624ac0f22e0f22b8625e71fa403dec87186ba485f7ea3f5b94ac
-
SSDEEP
98304:+1cUZ1F7yaCpZnVBmIc56xfW+ZOiPCMNHAXobR5brSIVc5irYkRf+DgAsHI8:+1fZ1F7yaCpZnVBmIc56xfW+ZdaMNHAm
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1256 wrote to memory of 4028 1256 rundll32.exe 84 PID 1256 wrote to memory of 4028 1256 rundll32.exe 84 PID 1256 wrote to memory of 4028 1256 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2159f145ac1262f8afe5c1c9f5b3377386bd65632aff191be5c06e374e046ec7.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2159f145ac1262f8afe5c1c9f5b3377386bd65632aff191be5c06e374e046ec7.dll,#12⤵PID:4028
-