Analysis
-
max time kernel
134s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
26/05/2024, 12:09
Static task
static1
Behavioral task
behavioral1
Sample
Windows.Storage.ApplicationData.dll
Resource
win7-20240508-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
Windows.Storage.ApplicationData.dll
Resource
win10v2004-20240426-en
1 signatures
150 seconds
General
-
Target
Windows.Storage.ApplicationData.dll
-
Size
147KB
-
MD5
0f5b44710f53e7d04f66fe1b0872e830
-
SHA1
bc8efdeea174e0fdcdf2bebb94450171d55932af
-
SHA256
48043bf01671e5863da76949289a731fc204bbdaf6cff7d1dc95c2504b6ceba9
-
SHA512
f9bdd8a36180eaaf78a2d9a496b4c46648ae45bab16a03e679557fe49ba19e38123d1d5fd760244dc4aaaf04f925f6feca3909689b243c9b45ddecc8c702a668
-
SSDEEP
3072:94kor9Li2i/HzJlcF5UCLkLg386DUHwqIrIn04DQj1kPTekw7x04i:e+ykLO86DgvIM04D9J+Di
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3412 wrote to memory of 4172 3412 rundll32.exe 82 PID 3412 wrote to memory of 4172 3412 rundll32.exe 82 PID 3412 wrote to memory of 4172 3412 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Windows.Storage.ApplicationData.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Windows.Storage.ApplicationData.dll,#12⤵PID:4172
-