Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23/04/2024, 02:51
Behavioral task
behavioral1
Sample
861c5199148ead6b38adc6b8b596ccd9c4752095121094ffe1d1ad21d701f05d.dll
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
861c5199148ead6b38adc6b8b596ccd9c4752095121094ffe1d1ad21d701f05d.dll
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
861c5199148ead6b38adc6b8b596ccd9c4752095121094ffe1d1ad21d701f05d.dll
-
Size
899KB
-
MD5
89a524e7cf2c4c9ff6761e60f5a780b9
-
SHA1
0a92e231635e55086497fb8adb967feabce7467d
-
SHA256
861c5199148ead6b38adc6b8b596ccd9c4752095121094ffe1d1ad21d701f05d
-
SHA512
8abc0582421595799c77c86dd7a9693d581f6bc418101e7c781bfa84a217bc901187999cf9d289a912acfe06d789efd5c1ef9daeb29cb4270c85302bf2330f63
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXs:7wqd87Vs
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2924 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3048 wrote to memory of 2924 3048 rundll32.exe 28 PID 3048 wrote to memory of 2924 3048 rundll32.exe 28 PID 3048 wrote to memory of 2924 3048 rundll32.exe 28 PID 3048 wrote to memory of 2924 3048 rundll32.exe 28 PID 3048 wrote to memory of 2924 3048 rundll32.exe 28 PID 3048 wrote to memory of 2924 3048 rundll32.exe 28 PID 3048 wrote to memory of 2924 3048 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\861c5199148ead6b38adc6b8b596ccd9c4752095121094ffe1d1ad21d701f05d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\861c5199148ead6b38adc6b8b596ccd9c4752095121094ffe1d1ad21d701f05d.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:2924
-