Analysis
-
max time kernel
93s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17/04/2024, 18:33
Static task
static1
Behavioral task
behavioral1
Sample
0c5b34d68cbcb7fb59596dcc80f7ee44746dfdc8f0d58e63e4599bd6ca8ce156.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0c5b34d68cbcb7fb59596dcc80f7ee44746dfdc8f0d58e63e4599bd6ca8ce156.dll
Resource
win10v2004-20240412-en
General
-
Target
0c5b34d68cbcb7fb59596dcc80f7ee44746dfdc8f0d58e63e4599bd6ca8ce156.dll
-
Size
6KB
-
MD5
2c39ffa31d345ba1590df58d99678cbc
-
SHA1
7c80f37fb7175c90696d379dc5b862cb9ee565ce
-
SHA256
0c5b34d68cbcb7fb59596dcc80f7ee44746dfdc8f0d58e63e4599bd6ca8ce156
-
SHA512
65c6ccd9fdfcdb75167a018dcc7b68d88e4950be14d50b7fe7a8b05552ec52593ed43ec1b8bce0c3b510edf72a47e1b5837debe6cd5d178aba8424a51a164779
-
SSDEEP
96:DixZjmjtjd8jPjcZGR5TIIm0JEJKzbfXxRwnJS91UpgJkdxejU/yT:unSR6bgY1m0q4XxRqRbejm
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1468 wrote to memory of 4280 1468 rundll32.exe 82 PID 1468 wrote to memory of 4280 1468 rundll32.exe 82 PID 1468 wrote to memory of 4280 1468 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c5b34d68cbcb7fb59596dcc80f7ee44746dfdc8f0d58e63e4599bd6ca8ce156.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0c5b34d68cbcb7fb59596dcc80f7ee44746dfdc8f0d58e63e4599bd6ca8ce156.dll,#12⤵PID:4280
-