Analysis
-
max time kernel
147s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
23/04/2024, 02:34
Behavioral task
behavioral1
Sample
f7225ce7f41445f9e87024ad5423d05e4d66854fbcc16881d03281c5661e01d5.dll
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
f7225ce7f41445f9e87024ad5423d05e4d66854fbcc16881d03281c5661e01d5.dll
Resource
win10v2004-20240412-en
2 signatures
150 seconds
General
-
Target
f7225ce7f41445f9e87024ad5423d05e4d66854fbcc16881d03281c5661e01d5.dll
-
Size
50KB
-
MD5
e99c0454fb91a11bbfd8c44743b3e219
-
SHA1
0d2cb3f4edcd44751efabb4835a7bc31b2cf117a
-
SHA256
f7225ce7f41445f9e87024ad5423d05e4d66854fbcc16881d03281c5661e01d5
-
SHA512
81400c1f6566ef75b868d14f89bcd67ffe025b79a495a86313f4e1e1f4d9e72381e4a181169cb169a4a79b835a79bd77a92b49678e7f124c0b1a49ad4607e60f
-
SSDEEP
1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5FJYH:W5ReWjTrW9rNPgYoPJYH
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2656 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4652 wrote to memory of 2656 4652 rundll32.exe 84 PID 4652 wrote to memory of 2656 4652 rundll32.exe 84 PID 4652 wrote to memory of 2656 4652 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f7225ce7f41445f9e87024ad5423d05e4d66854fbcc16881d03281c5661e01d5.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f7225ce7f41445f9e87024ad5423d05e4d66854fbcc16881d03281c5661e01d5.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:2656
-