Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
23/04/2024, 02:37
Behavioral task
behavioral1
Sample
3248877bdcc836588385d10e829f40d21bfa5f24d03654e2e52dfb763c793b34.dll
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
3248877bdcc836588385d10e829f40d21bfa5f24d03654e2e52dfb763c793b34.dll
Resource
win10v2004-20240412-en
2 signatures
150 seconds
General
-
Target
3248877bdcc836588385d10e829f40d21bfa5f24d03654e2e52dfb763c793b34.dll
-
Size
899KB
-
MD5
ba2d943852a0afe4f6975a19ae003bef
-
SHA1
18dc9555d325157516678bc9869c2626fe2c8662
-
SHA256
3248877bdcc836588385d10e829f40d21bfa5f24d03654e2e52dfb763c793b34
-
SHA512
eaca99bdb08e605a30b73375a5705f38890b88469e2dfe568ab752f57366a0fa265d0bdd18843d6d95f7d20c75b648541ad205e96b435ca7b3f6a910f92ab229
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXP:7wqd87VP
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2216 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 864 wrote to memory of 2216 864 rundll32.exe 85 PID 864 wrote to memory of 2216 864 rundll32.exe 85 PID 864 wrote to memory of 2216 864 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3248877bdcc836588385d10e829f40d21bfa5f24d03654e2e52dfb763c793b34.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3248877bdcc836588385d10e829f40d21bfa5f24d03654e2e52dfb763c793b34.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:2216
-