Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
23/04/2024, 02:35
Behavioral task
behavioral1
Sample
2a05181684cc231ba7745febd6adacd43f2e67d52406591dddfb9cdd4415f113.dll
Resource
win7-20240215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2a05181684cc231ba7745febd6adacd43f2e67d52406591dddfb9cdd4415f113.dll
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
2a05181684cc231ba7745febd6adacd43f2e67d52406591dddfb9cdd4415f113.dll
-
Size
51KB
-
MD5
a30d9aa270dc2faf11d0f0f4539380c2
-
SHA1
74bfe8821f0b3f92d76228ba0a1b813d69d67bc8
-
SHA256
2a05181684cc231ba7745febd6adacd43f2e67d52406591dddfb9cdd4415f113
-
SHA512
1d2ff107164e852e6434dce05d6ff8b1972cbc8559ddea2936434dbc50b9fdbe068317cb0520a0410505673655d0d0bc6ddbe5c8898ac6d755e43415725b4378
-
SSDEEP
1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL2JYH5:1dWubF3n9S91BF3fboiJYH5
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1920 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1600 wrote to memory of 1920 1600 rundll32.exe 28 PID 1600 wrote to memory of 1920 1600 rundll32.exe 28 PID 1600 wrote to memory of 1920 1600 rundll32.exe 28 PID 1600 wrote to memory of 1920 1600 rundll32.exe 28 PID 1600 wrote to memory of 1920 1600 rundll32.exe 28 PID 1600 wrote to memory of 1920 1600 rundll32.exe 28 PID 1600 wrote to memory of 1920 1600 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2a05181684cc231ba7745febd6adacd43f2e67d52406591dddfb9cdd4415f113.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2a05181684cc231ba7745febd6adacd43f2e67d52406591dddfb9cdd4415f113.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:1920
-