Analysis
-
max time kernel
146s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17/04/2024, 10:15
Behavioral task
behavioral1
Sample
9a2cdd4cfc2641a96b62b91eb3ba9047119ceaf6771cc618148e85fe1fbca351.dll
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
9a2cdd4cfc2641a96b62b91eb3ba9047119ceaf6771cc618148e85fe1fbca351.dll
Resource
win10v2004-20240412-en
2 signatures
150 seconds
General
-
Target
9a2cdd4cfc2641a96b62b91eb3ba9047119ceaf6771cc618148e85fe1fbca351.dll
-
Size
50KB
-
MD5
0124bdffc95ec882b245dcbd3a4786da
-
SHA1
d2e2b376c0265d25a3e9afc69395defea6acdf90
-
SHA256
9a2cdd4cfc2641a96b62b91eb3ba9047119ceaf6771cc618148e85fe1fbca351
-
SHA512
d820a70365d3b49d81a1a7d9a6bbba9c6dca776c45f50069644ce7e4151169e05aa41e5aa87bea5cdf6a4c99ea0c6d36e499284478216f8dafc1db13e266d279
-
SSDEEP
1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5IJYH:W5ReWjTrW9rNPgYoOJYH
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3952 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3564 wrote to memory of 3952 3564 rundll32.exe 84 PID 3564 wrote to memory of 3952 3564 rundll32.exe 84 PID 3564 wrote to memory of 3952 3564 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9a2cdd4cfc2641a96b62b91eb3ba9047119ceaf6771cc618148e85fe1fbca351.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9a2cdd4cfc2641a96b62b91eb3ba9047119ceaf6771cc618148e85fe1fbca351.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:3952
-