Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
23/04/2024, 02:46
Behavioral task
behavioral1
Sample
cc5fe7549766c010e9f2fb3e30b9c5c9d7b19b4741b1bdf5c798e6554c375f07.dll
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
cc5fe7549766c010e9f2fb3e30b9c5c9d7b19b4741b1bdf5c798e6554c375f07.dll
Resource
win10v2004-20240412-en
2 signatures
150 seconds
General
-
Target
cc5fe7549766c010e9f2fb3e30b9c5c9d7b19b4741b1bdf5c798e6554c375f07.dll
-
Size
899KB
-
MD5
b3b4d07ce114d05ab33ba8ea910c8207
-
SHA1
813208ae69dc96b2446a6a96ddcca16627976ca6
-
SHA256
cc5fe7549766c010e9f2fb3e30b9c5c9d7b19b4741b1bdf5c798e6554c375f07
-
SHA512
aa30e7b8351f70ffaf11505b91428a06a47dc17f2391d60b0c8f79d89162bc219e55923b38f11510ffe1c97351497aae71e69b297b7993508d9f2e1c96c2465b
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXN:7wqd87VN
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3316 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2388 wrote to memory of 3316 2388 rundll32.exe 85 PID 2388 wrote to memory of 3316 2388 rundll32.exe 85 PID 2388 wrote to memory of 3316 2388 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cc5fe7549766c010e9f2fb3e30b9c5c9d7b19b4741b1bdf5c798e6554c375f07.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cc5fe7549766c010e9f2fb3e30b9c5c9d7b19b4741b1bdf5c798e6554c375f07.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:3316
-