Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
19/04/2024, 04:49
Static task
static1
Behavioral task
behavioral1
Sample
f48a8599574f59e3edf9ee9c0f8a16608a90385d3678b9fa92797c127449e843.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
f48a8599574f59e3edf9ee9c0f8a16608a90385d3678b9fa92797c127449e843.dll
Resource
win10v2004-20240226-en
General
-
Target
f48a8599574f59e3edf9ee9c0f8a16608a90385d3678b9fa92797c127449e843.dll
-
Size
81KB
-
MD5
330e57597ccdbf6e39f012db3a8b9328
-
SHA1
f7a6017d61367d3bec4d371b5a27f14341f28ae2
-
SHA256
f48a8599574f59e3edf9ee9c0f8a16608a90385d3678b9fa92797c127449e843
-
SHA512
931054e4bd036a5bf5153f63ed85f0b10b7dea746117a9b880a065e88a4e87174860f0ee0edfe2fc8589fbe3a9364b57a8592c65568a4ae3ad0ff1b1da02d766
-
SSDEEP
1536:fc+UPvS0RKCmqAvj45Hx8u05iecuYSoosWaocdBkez0U+Ga:0+5oxmqAiR8+/RBkez0U+R
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1368 wrote to memory of 2392 1368 rundll32.exe 28 PID 1368 wrote to memory of 2392 1368 rundll32.exe 28 PID 1368 wrote to memory of 2392 1368 rundll32.exe 28 PID 1368 wrote to memory of 2392 1368 rundll32.exe 28 PID 1368 wrote to memory of 2392 1368 rundll32.exe 28 PID 1368 wrote to memory of 2392 1368 rundll32.exe 28 PID 1368 wrote to memory of 2392 1368 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f48a8599574f59e3edf9ee9c0f8a16608a90385d3678b9fa92797c127449e843.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f48a8599574f59e3edf9ee9c0f8a16608a90385d3678b9fa92797c127449e843.dll,#12⤵PID:2392
-