Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
12/06/2024, 15:11
Static task
static1
Behavioral task
behavioral1
Sample
Feather Calculator.application
Resource
win7-20231129-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
Feather Calculator.application
Resource
win10v2004-20240508-en
1 signatures
150 seconds
General
-
Target
Feather Calculator.application
-
Size
5KB
-
MD5
698d7dfa74aebb747b32ea4488cefa06
-
SHA1
39a709817d57cdf4543684087d8da85f3b8f8082
-
SHA256
1d1a3c9b4ace7d03691a6b3adfd376de6a28b3df1ae1b0e29c108df4e02dcc87
-
SHA512
1dd466edd7efc73b7e75b60e1d376b76d428eb0b6cf2c60ec4456b049b8a0338f5c9a554421a355499834a71c6dfc3b202bbdb86ce24042cccde0fda86b07194
-
SSDEEP
96:0WLwO9Zc2QcYk3PkV6byXomO3KadEkXXo7eayGBDA:feVmecnESQA
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2024 wrote to memory of 2428 2024 rundll32.exe 28 PID 2024 wrote to memory of 2428 2024 rundll32.exe 28 PID 2024 wrote to memory of 2428 2024 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe dfshim.dll,ShOpenVerbApplication "C:\Users\Admin\AppData\Local\Temp\Feather Calculator.application"1⤵
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"2⤵PID:2428
-