Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23/04/2024, 02:34
Behavioral task
behavioral1
Sample
f7225ce7f41445f9e87024ad5423d05e4d66854fbcc16881d03281c5661e01d5.dll
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
f7225ce7f41445f9e87024ad5423d05e4d66854fbcc16881d03281c5661e01d5.dll
Resource
win10v2004-20240412-en
2 signatures
150 seconds
General
-
Target
f7225ce7f41445f9e87024ad5423d05e4d66854fbcc16881d03281c5661e01d5.dll
-
Size
50KB
-
MD5
e99c0454fb91a11bbfd8c44743b3e219
-
SHA1
0d2cb3f4edcd44751efabb4835a7bc31b2cf117a
-
SHA256
f7225ce7f41445f9e87024ad5423d05e4d66854fbcc16881d03281c5661e01d5
-
SHA512
81400c1f6566ef75b868d14f89bcd67ffe025b79a495a86313f4e1e1f4d9e72381e4a181169cb169a4a79b835a79bd77a92b49678e7f124c0b1a49ad4607e60f
-
SSDEEP
1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5FJYH:W5ReWjTrW9rNPgYoPJYH
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2044 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2952 wrote to memory of 2044 2952 rundll32.exe 28 PID 2952 wrote to memory of 2044 2952 rundll32.exe 28 PID 2952 wrote to memory of 2044 2952 rundll32.exe 28 PID 2952 wrote to memory of 2044 2952 rundll32.exe 28 PID 2952 wrote to memory of 2044 2952 rundll32.exe 28 PID 2952 wrote to memory of 2044 2952 rundll32.exe 28 PID 2952 wrote to memory of 2044 2952 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f7225ce7f41445f9e87024ad5423d05e4d66854fbcc16881d03281c5661e01d5.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f7225ce7f41445f9e87024ad5423d05e4d66854fbcc16881d03281c5661e01d5.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:2044
-