Analysis
-
max time kernel
131s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 23:39
Static task
static1
Behavioral task
behavioral1
Sample
800a1ab8ba699ddecb761fba39d5b54b32a6f2afa5f4d8294326539a71099a32.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
800a1ab8ba699ddecb761fba39d5b54b32a6f2afa5f4d8294326539a71099a32.dll
Resource
win10v2004-20240508-en
General
-
Target
800a1ab8ba699ddecb761fba39d5b54b32a6f2afa5f4d8294326539a71099a32.dll
-
Size
5KB
-
MD5
11ca7f4aff4b7c9d27f136e1f7a13346
-
SHA1
3d9d8d1bda2cc5fb23f2d13f5801ada95d78565e
-
SHA256
800a1ab8ba699ddecb761fba39d5b54b32a6f2afa5f4d8294326539a71099a32
-
SHA512
58147d06c2eea5fb903a0c9986efc662a6e32d8385e3f392826298e2ebda3fa6c61a706cfdd1ee95c529f755a0a70fb3d8e50ffa5c11358febc23cef08d99507
-
SSDEEP
48:CCy86+Wet9Q/iooHeiefhe+/lSMYEq1VDffqZb/xRWAO0NwQvWYwGsEehn9Bd3U/:hy859x0P8MafrqZb3NDejGsEinW/
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4692 wrote to memory of 1724 4692 rundll32.exe rundll32.exe PID 4692 wrote to memory of 1724 4692 rundll32.exe rundll32.exe PID 4692 wrote to memory of 1724 4692 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\800a1ab8ba699ddecb761fba39d5b54b32a6f2afa5f4d8294326539a71099a32.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\800a1ab8ba699ddecb761fba39d5b54b32a6f2afa5f4d8294326539a71099a32.dll,#12⤵