Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
23/04/2024, 02:30
Behavioral task
behavioral1
Sample
343f673bf1a0996b98296e52fb006fd51e8a5b6b8354f7ec96c29e58768d1052.dll
Resource
win7-20231129-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
343f673bf1a0996b98296e52fb006fd51e8a5b6b8354f7ec96c29e58768d1052.dll
Resource
win10v2004-20240412-en
2 signatures
150 seconds
General
-
Target
343f673bf1a0996b98296e52fb006fd51e8a5b6b8354f7ec96c29e58768d1052.dll
-
Size
51KB
-
MD5
fb6f29475b1624704367ed59bf15af94
-
SHA1
307b556358ed1b57b5f913633af0157912f22a8e
-
SHA256
343f673bf1a0996b98296e52fb006fd51e8a5b6b8354f7ec96c29e58768d1052
-
SHA512
bc6015f13f08ad6884298b1f5da7950e3ebf628d425d4cb7f845c285d91cdcce5c336192a84bbd7a6aaa1ac4b96d1a121d004dff90912eb4f3e4fe1949f85b32
-
SSDEEP
1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLVJYH5:1dWubF3n9S91BF3fboJJYH5
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1932 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1988 wrote to memory of 1932 1988 rundll32.exe 28 PID 1988 wrote to memory of 1932 1988 rundll32.exe 28 PID 1988 wrote to memory of 1932 1988 rundll32.exe 28 PID 1988 wrote to memory of 1932 1988 rundll32.exe 28 PID 1988 wrote to memory of 1932 1988 rundll32.exe 28 PID 1988 wrote to memory of 1932 1988 rundll32.exe 28 PID 1988 wrote to memory of 1932 1988 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\343f673bf1a0996b98296e52fb006fd51e8a5b6b8354f7ec96c29e58768d1052.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\343f673bf1a0996b98296e52fb006fd51e8a5b6b8354f7ec96c29e58768d1052.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:1932
-