Analysis
-
max time kernel
139s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
23/04/2024, 02:45
Behavioral task
behavioral1
Sample
8b353a8ea3e06db39c51c78e22b9544f56b85c8d2894989b5cca5b5d933dea8b.dll
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
8b353a8ea3e06db39c51c78e22b9544f56b85c8d2894989b5cca5b5d933dea8b.dll
Resource
win10v2004-20240412-en
2 signatures
150 seconds
General
-
Target
8b353a8ea3e06db39c51c78e22b9544f56b85c8d2894989b5cca5b5d933dea8b.dll
-
Size
50KB
-
MD5
596c4ea5b387d341f53aefe4562c077d
-
SHA1
4102646f4ce4c80748d8dd3fb043d03a80cfd342
-
SHA256
8b353a8ea3e06db39c51c78e22b9544f56b85c8d2894989b5cca5b5d933dea8b
-
SHA512
7dc2c94c7436b0111097cb7972386b34da1b3ada49757a3c150e7224ed7446b8c62b45baaa42994a1f8b6844be9acbe0e1ce42693c07a1c2d1f7622a96d3affa
-
SSDEEP
1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5aJYH:W5ReWjTrW9rNPgYoYJYH
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3716 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2588 wrote to memory of 3716 2588 rundll32.exe 86 PID 2588 wrote to memory of 3716 2588 rundll32.exe 86 PID 2588 wrote to memory of 3716 2588 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8b353a8ea3e06db39c51c78e22b9544f56b85c8d2894989b5cca5b5d933dea8b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8b353a8ea3e06db39c51c78e22b9544f56b85c8d2894989b5cca5b5d933dea8b.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:3716
-