Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 00:12
Static task
static1
Behavioral task
behavioral1
Sample
5f6d86a873e8a2ce8f2760f2cc1a6f6c7a765d08b831565c25492852c87da40e.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
5f6d86a873e8a2ce8f2760f2cc1a6f6c7a765d08b831565c25492852c87da40e.dll
Resource
win10v2004-20240508-en
General
-
Target
5f6d86a873e8a2ce8f2760f2cc1a6f6c7a765d08b831565c25492852c87da40e.dll
-
Size
5KB
-
MD5
f42c6abb9a2fe972827b304fafc5c840
-
SHA1
f427e77b1c505245f33673abd89ef6ff03eccb7e
-
SHA256
5f6d86a873e8a2ce8f2760f2cc1a6f6c7a765d08b831565c25492852c87da40e
-
SHA512
e81079d89fbe996021d80e47905b41bcdd343d1d21104727350e597a6a9103c73dfc0fe49c733a25fae50101e7578bde5371e007fbad5d8a27c709df85fbc77a
-
SSDEEP
48:CCy86+Wet9Q/iooHeiefhe+/lSMYEql7A03gMAPyczdcWAa04d4ggnbn7zl2Mkgy:hy859x0P8MaKSAPBAzRzl29
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 3000 wrote to memory of 3024 3000 rundll32.exe rundll32.exe PID 3000 wrote to memory of 3024 3000 rundll32.exe rundll32.exe PID 3000 wrote to memory of 3024 3000 rundll32.exe rundll32.exe PID 3000 wrote to memory of 3024 3000 rundll32.exe rundll32.exe PID 3000 wrote to memory of 3024 3000 rundll32.exe rundll32.exe PID 3000 wrote to memory of 3024 3000 rundll32.exe rundll32.exe PID 3000 wrote to memory of 3024 3000 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5f6d86a873e8a2ce8f2760f2cc1a6f6c7a765d08b831565c25492852c87da40e.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5f6d86a873e8a2ce8f2760f2cc1a6f6c7a765d08b831565c25492852c87da40e.dll,#12⤵