Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
23/04/2024, 02:54
Behavioral task
behavioral1
Sample
0da967af7cfe39c9aaf70b956e806181bc91bceb31dc0691276a56d9b9d458b3.dll
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
0da967af7cfe39c9aaf70b956e806181bc91bceb31dc0691276a56d9b9d458b3.dll
Resource
win10v2004-20240412-en
2 signatures
150 seconds
General
-
Target
0da967af7cfe39c9aaf70b956e806181bc91bceb31dc0691276a56d9b9d458b3.dll
-
Size
50KB
-
MD5
0a0a03149af10cc9786e9fc95a2ccdef
-
SHA1
409a14b0b804bdf8b49345291358282411d79da8
-
SHA256
0da967af7cfe39c9aaf70b956e806181bc91bceb31dc0691276a56d9b9d458b3
-
SHA512
dbc924a9b3269cb1525b4d9324da0b7a9dd90748677bf10a3a38c84644c5b8db16ce05dccb1e7974481f3cf7cdc5af5ab7613affe53e71a7ff2e2d39489497b0
-
SSDEEP
1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5tJYH:W5ReWjTrW9rNPgYojJYH
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2624 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4564 wrote to memory of 2624 4564 rundll32.exe 85 PID 4564 wrote to memory of 2624 4564 rundll32.exe 85 PID 4564 wrote to memory of 2624 4564 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0da967af7cfe39c9aaf70b956e806181bc91bceb31dc0691276a56d9b9d458b3.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0da967af7cfe39c9aaf70b956e806181bc91bceb31dc0691276a56d9b9d458b3.dll,#12⤵
- Suspicious behavior: RenamesItself
PID:2624
-