Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 01:39
Static task
static1
Behavioral task
behavioral1
Sample
6f7d9c6f05de0f24f0d3e26bdc5d3f2d6e59bf6a1ea3eff6670fabe60899d550.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
6f7d9c6f05de0f24f0d3e26bdc5d3f2d6e59bf6a1ea3eff6670fabe60899d550.dll
Resource
win10v2004-20240426-en
General
-
Target
6f7d9c6f05de0f24f0d3e26bdc5d3f2d6e59bf6a1ea3eff6670fabe60899d550.dll
-
Size
862KB
-
MD5
5406a3415c61f9ffebd290234021e750
-
SHA1
5d03b07c4b760e03123c99ee78d199c39efafcf5
-
SHA256
6f7d9c6f05de0f24f0d3e26bdc5d3f2d6e59bf6a1ea3eff6670fabe60899d550
-
SHA512
6041b5bf1bd05c2d0be8b9d99ec8c068274c5d854193cd1a3d9bb2544a45cdd8fe87bdb8c4291307ff3a83890ed42572ddfa1985b9ed745fd296da6d3dfdd5c3
-
SSDEEP
12288:cbxMQ0Ta1r4TGup9LKPi4jgUtxA4EvGeEPhlEFXLIQ3v5ZFLS5t4v2CDGmPok6:cslgxA4EvG5PhlExLNrFLS5t4eCD3od
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1404 wrote to memory of 1936 1404 rundll32.exe rundll32.exe PID 1404 wrote to memory of 1936 1404 rundll32.exe rundll32.exe PID 1404 wrote to memory of 1936 1404 rundll32.exe rundll32.exe PID 1404 wrote to memory of 1936 1404 rundll32.exe rundll32.exe PID 1404 wrote to memory of 1936 1404 rundll32.exe rundll32.exe PID 1404 wrote to memory of 1936 1404 rundll32.exe rundll32.exe PID 1404 wrote to memory of 1936 1404 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6f7d9c6f05de0f24f0d3e26bdc5d3f2d6e59bf6a1ea3eff6670fabe60899d550.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6f7d9c6f05de0f24f0d3e26bdc5d3f2d6e59bf6a1ea3eff6670fabe60899d550.dll,#12⤵PID:1936