Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23/04/2024, 02:54
Behavioral task
behavioral1
Sample
0da967af7cfe39c9aaf70b956e806181bc91bceb31dc0691276a56d9b9d458b3.dll
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
0da967af7cfe39c9aaf70b956e806181bc91bceb31dc0691276a56d9b9d458b3.dll
Resource
win10v2004-20240412-en
2 signatures
150 seconds
General
-
Target
0da967af7cfe39c9aaf70b956e806181bc91bceb31dc0691276a56d9b9d458b3.dll
-
Size
50KB
-
MD5
0a0a03149af10cc9786e9fc95a2ccdef
-
SHA1
409a14b0b804bdf8b49345291358282411d79da8
-
SHA256
0da967af7cfe39c9aaf70b956e806181bc91bceb31dc0691276a56d9b9d458b3
-
SHA512
dbc924a9b3269cb1525b4d9324da0b7a9dd90748677bf10a3a38c84644c5b8db16ce05dccb1e7974481f3cf7cdc5af5ab7613affe53e71a7ff2e2d39489497b0
-
SSDEEP
1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5tJYH:W5ReWjTrW9rNPgYojJYH
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1648 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2528 wrote to memory of 1648 2528 rundll32.exe 28 PID 2528 wrote to memory of 1648 2528 rundll32.exe 28 PID 2528 wrote to memory of 1648 2528 rundll32.exe 28 PID 2528 wrote to memory of 1648 2528 rundll32.exe 28 PID 2528 wrote to memory of 1648 2528 rundll32.exe 28 PID 2528 wrote to memory of 1648 2528 rundll32.exe 28 PID 2528 wrote to memory of 1648 2528 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0da967af7cfe39c9aaf70b956e806181bc91bceb31dc0691276a56d9b9d458b3.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0da967af7cfe39c9aaf70b956e806181bc91bceb31dc0691276a56d9b9d458b3.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:1648
-