Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 03:48
Static task
static1
Behavioral task
behavioral1
Sample
16c820c2dd1bb63ed507b671f834ca42d752a606cd72ed730ca5aafca9b1a3f7.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
16c820c2dd1bb63ed507b671f834ca42d752a606cd72ed730ca5aafca9b1a3f7.dll
Resource
win10v2004-20240426-en
General
-
Target
16c820c2dd1bb63ed507b671f834ca42d752a606cd72ed730ca5aafca9b1a3f7.dll
-
Size
81KB
-
MD5
05c3b9165a1cfb20e1b565725c4414c0
-
SHA1
cd844d4c7fc748b54fdd86f2f43526e0747be4f2
-
SHA256
16c820c2dd1bb63ed507b671f834ca42d752a606cd72ed730ca5aafca9b1a3f7
-
SHA512
008378ccd177aabc93f159ce00db20e5bdb154d8ff2f51b3d426f9058d64027f6d73b837092f84f7085d2a3d008deae0771c780492e46ba698bfb75ef85d1e9f
-
SSDEEP
1536:YtByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8Wm:Y4v4JKXTx71w0ArSsXF3enq8Wm
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 2420 wrote to memory of 1004 2420 rundll32.exe rundll32.exe PID 2420 wrote to memory of 1004 2420 rundll32.exe rundll32.exe PID 2420 wrote to memory of 1004 2420 rundll32.exe rundll32.exe PID 2420 wrote to memory of 1004 2420 rundll32.exe rundll32.exe PID 2420 wrote to memory of 1004 2420 rundll32.exe rundll32.exe PID 2420 wrote to memory of 1004 2420 rundll32.exe rundll32.exe PID 2420 wrote to memory of 1004 2420 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\16c820c2dd1bb63ed507b671f834ca42d752a606cd72ed730ca5aafca9b1a3f7.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\16c820c2dd1bb63ed507b671f834ca42d752a606cd72ed730ca5aafca9b1a3f7.dll,#12⤵