Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23/04/2024, 02:37
Behavioral task
behavioral1
Sample
3248877bdcc836588385d10e829f40d21bfa5f24d03654e2e52dfb763c793b34.dll
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
3248877bdcc836588385d10e829f40d21bfa5f24d03654e2e52dfb763c793b34.dll
Resource
win10v2004-20240412-en
2 signatures
150 seconds
General
-
Target
3248877bdcc836588385d10e829f40d21bfa5f24d03654e2e52dfb763c793b34.dll
-
Size
899KB
-
MD5
ba2d943852a0afe4f6975a19ae003bef
-
SHA1
18dc9555d325157516678bc9869c2626fe2c8662
-
SHA256
3248877bdcc836588385d10e829f40d21bfa5f24d03654e2e52dfb763c793b34
-
SHA512
eaca99bdb08e605a30b73375a5705f38890b88469e2dfe568ab752f57366a0fa265d0bdd18843d6d95f7d20c75b648541ad205e96b435ca7b3f6a910f92ab229
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXP:7wqd87VP
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2992 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2928 wrote to memory of 2992 2928 rundll32.exe 28 PID 2928 wrote to memory of 2992 2928 rundll32.exe 28 PID 2928 wrote to memory of 2992 2928 rundll32.exe 28 PID 2928 wrote to memory of 2992 2928 rundll32.exe 28 PID 2928 wrote to memory of 2992 2928 rundll32.exe 28 PID 2928 wrote to memory of 2992 2928 rundll32.exe 28 PID 2928 wrote to memory of 2992 2928 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3248877bdcc836588385d10e829f40d21bfa5f24d03654e2e52dfb763c793b34.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3248877bdcc836588385d10e829f40d21bfa5f24d03654e2e52dfb763c793b34.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:2992
-