Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
23/04/2024, 02:41
Behavioral task
behavioral1
Sample
61d7af9d03e53e90bcad28afb6b80f4d59fd44f6aa882fd7d8327b7e6f3368b8.dll
Resource
win7-20240215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
61d7af9d03e53e90bcad28afb6b80f4d59fd44f6aa882fd7d8327b7e6f3368b8.dll
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
61d7af9d03e53e90bcad28afb6b80f4d59fd44f6aa882fd7d8327b7e6f3368b8.dll
-
Size
899KB
-
MD5
3ce4131a705a98acb3742c16290637d1
-
SHA1
5e074d237413db6ed3029201a0dd76b31b73490a
-
SHA256
61d7af9d03e53e90bcad28afb6b80f4d59fd44f6aa882fd7d8327b7e6f3368b8
-
SHA512
bb9cb4bdae94881983ebdda4fa872f20738679b9968cfb2aec444342c8790a50c089f5e9bc40c49cd4e6839737f4510b6f29d2f9c54dfa6cd991a7f24a7f167a
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXx:7wqd87Vx
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 764 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2416 wrote to memory of 764 2416 rundll32.exe 28 PID 2416 wrote to memory of 764 2416 rundll32.exe 28 PID 2416 wrote to memory of 764 2416 rundll32.exe 28 PID 2416 wrote to memory of 764 2416 rundll32.exe 28 PID 2416 wrote to memory of 764 2416 rundll32.exe 28 PID 2416 wrote to memory of 764 2416 rundll32.exe 28 PID 2416 wrote to memory of 764 2416 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\61d7af9d03e53e90bcad28afb6b80f4d59fd44f6aa882fd7d8327b7e6f3368b8.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\61d7af9d03e53e90bcad28afb6b80f4d59fd44f6aa882fd7d8327b7e6f3368b8.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:764
-