Analysis
-
max time kernel
121s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23/04/2024, 02:45
Behavioral task
behavioral1
Sample
8b353a8ea3e06db39c51c78e22b9544f56b85c8d2894989b5cca5b5d933dea8b.dll
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
8b353a8ea3e06db39c51c78e22b9544f56b85c8d2894989b5cca5b5d933dea8b.dll
Resource
win10v2004-20240412-en
2 signatures
150 seconds
General
-
Target
8b353a8ea3e06db39c51c78e22b9544f56b85c8d2894989b5cca5b5d933dea8b.dll
-
Size
50KB
-
MD5
596c4ea5b387d341f53aefe4562c077d
-
SHA1
4102646f4ce4c80748d8dd3fb043d03a80cfd342
-
SHA256
8b353a8ea3e06db39c51c78e22b9544f56b85c8d2894989b5cca5b5d933dea8b
-
SHA512
7dc2c94c7436b0111097cb7972386b34da1b3ada49757a3c150e7224ed7446b8c62b45baaa42994a1f8b6844be9acbe0e1ce42693c07a1c2d1f7622a96d3affa
-
SSDEEP
1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5aJYH:W5ReWjTrW9rNPgYoYJYH
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2264 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2196 wrote to memory of 2264 2196 rundll32.exe 28 PID 2196 wrote to memory of 2264 2196 rundll32.exe 28 PID 2196 wrote to memory of 2264 2196 rundll32.exe 28 PID 2196 wrote to memory of 2264 2196 rundll32.exe 28 PID 2196 wrote to memory of 2264 2196 rundll32.exe 28 PID 2196 wrote to memory of 2264 2196 rundll32.exe 28 PID 2196 wrote to memory of 2264 2196 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8b353a8ea3e06db39c51c78e22b9544f56b85c8d2894989b5cca5b5d933dea8b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8b353a8ea3e06db39c51c78e22b9544f56b85c8d2894989b5cca5b5d933dea8b.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:2264
-