Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
15-05-2024 19:17
Behavioral task
behavioral1
Sample
c52557ba95a457c0e4de753c8fec1771faf094f0717934e3ef1b20cfdf200a42.dll
Resource
win7-20240508-en
4 signatures
150 seconds
General
-
Target
c52557ba95a457c0e4de753c8fec1771faf094f0717934e3ef1b20cfdf200a42.dll
-
Size
39KB
-
MD5
306d01d26d82998b1d99404b0d0b6805
-
SHA1
f48ad671df396e033deee8bc8c8b197ae95c6398
-
SHA256
c52557ba95a457c0e4de753c8fec1771faf094f0717934e3ef1b20cfdf200a42
-
SHA512
f62806571ccf08560bbfdd28b156d968006df651a70eef1f1bc4c8a6b76189373c4c20a8605f2b17bc3e2b979325598d1afc06d8deb755b9f7197d1236086f19
-
SSDEEP
768:nVC7MZmIOUbW9aKan5G9YHyybcS+LS0whGfxzv7f:RZqU9LnZjMG0whE
Malware Config
Signatures
-
Detect Blackmoon payload 3 IoCs
resource yara_rule behavioral2/memory/2924-0-0x0000000010000000-0x0000000010030000-memory.dmp family_blackmoon behavioral2/memory/2924-1-0x0000000010000000-0x0000000010030000-memory.dmp family_blackmoon behavioral2/memory/2924-3-0x0000000010000000-0x0000000010030000-memory.dmp family_blackmoon -
resource yara_rule behavioral2/memory/2924-2-0x00000000012B0000-0x00000000012BB000-memory.dmp upx behavioral2/memory/2924-4-0x00000000012B0000-0x00000000012BB000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2020 wrote to memory of 2924 2020 rundll32.exe 82 PID 2020 wrote to memory of 2924 2020 rundll32.exe 82 PID 2020 wrote to memory of 2924 2020 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c52557ba95a457c0e4de753c8fec1771faf094f0717934e3ef1b20cfdf200a42.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c52557ba95a457c0e4de753c8fec1771faf094f0717934e3ef1b20cfdf200a42.dll,#12⤵PID:2924
-