Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 22:25
Static task
static1
Behavioral task
behavioral1
Sample
4b7d8af15cfc7d56a6c372a356d74dcc550af254fd0ece92dfeea8ffb60e32e8.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
4b7d8af15cfc7d56a6c372a356d74dcc550af254fd0ece92dfeea8ffb60e32e8.dll
Resource
win10v2004-20240508-en
General
-
Target
4b7d8af15cfc7d56a6c372a356d74dcc550af254fd0ece92dfeea8ffb60e32e8.dll
-
Size
81KB
-
MD5
162df44d34a39aedf0993d678a7824f0
-
SHA1
9831a401497a1652da22648a8a82e431254de8b8
-
SHA256
4b7d8af15cfc7d56a6c372a356d74dcc550af254fd0ece92dfeea8ffb60e32e8
-
SHA512
ecef0f0e7d470a172048babf1cd2a3c93396a89f511625d7d1cb01a80d405238d1f9720e16cf2e906922c06926444cf8e76e1d6c998c61aa5d4196523c06fe54
-
SSDEEP
1536:8tByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8Wd:84v4JKXTx71w0ArSsXF3enq8Wd
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 2364 wrote to memory of 2200 2364 rundll32.exe rundll32.exe PID 2364 wrote to memory of 2200 2364 rundll32.exe rundll32.exe PID 2364 wrote to memory of 2200 2364 rundll32.exe rundll32.exe PID 2364 wrote to memory of 2200 2364 rundll32.exe rundll32.exe PID 2364 wrote to memory of 2200 2364 rundll32.exe rundll32.exe PID 2364 wrote to memory of 2200 2364 rundll32.exe rundll32.exe PID 2364 wrote to memory of 2200 2364 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4b7d8af15cfc7d56a6c372a356d74dcc550af254fd0ece92dfeea8ffb60e32e8.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4b7d8af15cfc7d56a6c372a356d74dcc550af254fd0ece92dfeea8ffb60e32e8.dll,#12⤵PID:2200
-