Analysis
-
max time kernel
134s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
18-04-2024 04:34
Behavioral task
behavioral1
Sample
116e154ddd60ba9c3791f31a8800ff43a30b0d98c8c97e18251417b896215f50.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
116e154ddd60ba9c3791f31a8800ff43a30b0d98c8c97e18251417b896215f50.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
116e154ddd60ba9c3791f31a8800ff43a30b0d98c8c97e18251417b896215f50.dll
-
Size
51KB
-
MD5
b105979774741a8f6f25bd4a2ceadd92
-
SHA1
e36b22bc407b97e6ba6f830bb706db5a2349f1da
-
SHA256
116e154ddd60ba9c3791f31a8800ff43a30b0d98c8c97e18251417b896215f50
-
SHA512
761eb0b613d77c55e1501824961ed1fa06635d788240f711648acadd64aa68377ff96010d7d0ba1f3dc33cc6d834c0a04e39c875261bd145dae9de6ca8a72b79
-
SSDEEP
1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLSJYH5:1dWubF3n9S91BF3fboeJYH5
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3388 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3444 wrote to memory of 3388 3444 rundll32.exe 88 PID 3444 wrote to memory of 3388 3444 rundll32.exe 88 PID 3444 wrote to memory of 3388 3444 rundll32.exe 88
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\116e154ddd60ba9c3791f31a8800ff43a30b0d98c8c97e18251417b896215f50.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\116e154ddd60ba9c3791f31a8800ff43a30b0d98c8c97e18251417b896215f50.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:3388
-