Analysis
-
max time kernel
134s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 14:35
Static task
static1
Behavioral task
behavioral1
Sample
915cd98e7f26f30be8f8ef0be7e4288490a61de9525d130cd200c3264e6fe624.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
915cd98e7f26f30be8f8ef0be7e4288490a61de9525d130cd200c3264e6fe624.dll
Resource
win10v2004-20240426-en
General
-
Target
915cd98e7f26f30be8f8ef0be7e4288490a61de9525d130cd200c3264e6fe624.dll
-
Size
2.0MB
-
MD5
93df2de8f04b546bb9c29dba027c0f11
-
SHA1
8907ac183f171d81973c85f4f61606b71472357f
-
SHA256
915cd98e7f26f30be8f8ef0be7e4288490a61de9525d130cd200c3264e6fe624
-
SHA512
1529115e47927ea88116469074f36c4abc6569bff47cdc03ef2681171bc2e6fd0c4897c5b596a86a6b62d459d2dc31296c84fa0dc4af5fce2b0ee1c61a83a0d2
-
SSDEEP
24576:cYG7K9TL9iSQCDvoivLDgpYpk9MRS+MKMGAPG4tQRwLs57kcJrVhW4LfmiMg9fvX:cNe0JCDepmqOSBxLsrJpNzmLg9fvw6
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1016 wrote to memory of 2420 1016 rundll32.exe rundll32.exe PID 1016 wrote to memory of 2420 1016 rundll32.exe rundll32.exe PID 1016 wrote to memory of 2420 1016 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\915cd98e7f26f30be8f8ef0be7e4288490a61de9525d130cd200c3264e6fe624.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\915cd98e7f26f30be8f8ef0be7e4288490a61de9525d130cd200c3264e6fe624.dll,#12⤵