Analysis
-
max time kernel
141s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
23/04/2024, 02:50
Behavioral task
behavioral1
Sample
6b9e4d48e0a993266bb4f935bc66bb857bd4ef2f744f734ab2587b7877add816.dll
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
6b9e4d48e0a993266bb4f935bc66bb857bd4ef2f744f734ab2587b7877add816.dll
Resource
win10v2004-20240412-en
2 signatures
150 seconds
General
-
Target
6b9e4d48e0a993266bb4f935bc66bb857bd4ef2f744f734ab2587b7877add816.dll
-
Size
899KB
-
MD5
68c9de7df87d74350fa1993c362eeff5
-
SHA1
6daeec96afe5888c8382e70834ca706128835b82
-
SHA256
6b9e4d48e0a993266bb4f935bc66bb857bd4ef2f744f734ab2587b7877add816
-
SHA512
1d9cbe5888f901913ba95af1f3618adc1391b81ed871c4d995dee192fa133ca62ce46d2a40aef0a305bd0a9e42f2052396e1c0501a301ba8ab321dbb2b6cd92d
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PX9:7wqd87V9
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4732 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4044 wrote to memory of 4732 4044 rundll32.exe 86 PID 4044 wrote to memory of 4732 4044 rundll32.exe 86 PID 4044 wrote to memory of 4732 4044 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6b9e4d48e0a993266bb4f935bc66bb857bd4ef2f744f734ab2587b7877add816.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6b9e4d48e0a993266bb4f935bc66bb857bd4ef2f744f734ab2587b7877add816.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:4732
-