Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17/04/2024, 22:40
Behavioral task
behavioral1
Sample
eadcb36dcc7a12f134838308218b0cef9209f591ec980203f6eb8f517a6f31c2.dll
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
eadcb36dcc7a12f134838308218b0cef9209f591ec980203f6eb8f517a6f31c2.dll
Resource
win10v2004-20240412-en
2 signatures
150 seconds
General
-
Target
eadcb36dcc7a12f134838308218b0cef9209f591ec980203f6eb8f517a6f31c2.dll
-
Size
899KB
-
MD5
1f8f6d339e48c40694e9cc73cfb02096
-
SHA1
f2b599a9b2fd13bdea0617821ea6011f8a43a83e
-
SHA256
eadcb36dcc7a12f134838308218b0cef9209f591ec980203f6eb8f517a6f31c2
-
SHA512
c9279761eabc0eaee9cb80b31e4e5536c7384b757198774df6f363b084cdb63b104bbeae8d3f7790780cf7fe721db6d5e9587d281421baacb473e58e0b9a8b48
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PX6:7wqd87V6
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2684 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2492 wrote to memory of 2684 2492 rundll32.exe 28 PID 2492 wrote to memory of 2684 2492 rundll32.exe 28 PID 2492 wrote to memory of 2684 2492 rundll32.exe 28 PID 2492 wrote to memory of 2684 2492 rundll32.exe 28 PID 2492 wrote to memory of 2684 2492 rundll32.exe 28 PID 2492 wrote to memory of 2684 2492 rundll32.exe 28 PID 2492 wrote to memory of 2684 2492 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eadcb36dcc7a12f134838308218b0cef9209f591ec980203f6eb8f517a6f31c2.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eadcb36dcc7a12f134838308218b0cef9209f591ec980203f6eb8f517a6f31c2.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:2684
-