Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
14-06-2024 01:48
Static task
static1
Behavioral task
behavioral1
Sample
9b7406dd2bd4a581271f4f2715d7d6c997e5766929c8fcc566972a70e5fd3405.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
9b7406dd2bd4a581271f4f2715d7d6c997e5766929c8fcc566972a70e5fd3405.dll
Resource
win10v2004-20240611-en
General
-
Target
9b7406dd2bd4a581271f4f2715d7d6c997e5766929c8fcc566972a70e5fd3405.dll
-
Size
854KB
-
MD5
528fa988f93f5157fa9097c19a06376a
-
SHA1
eb451bfb417ef41d882ce955ba0ea53fa2c1cc3d
-
SHA256
9b7406dd2bd4a581271f4f2715d7d6c997e5766929c8fcc566972a70e5fd3405
-
SHA512
3aaaf564343b7e84294bb003996cc778865870ecae1a177ec11fdb32b34464e24350262c7d00718dfd1cd120fc4a2d4d2dfb7588b7cfde48355c5790c5523b9f
-
SSDEEP
12288:Grk1jWLI5SpfGrcwg8GRgyOOOOOOOOOYBlnGxp/J/dOZ/i00wnD1XHJshBmNVSJ9:GrnEMP+CI/JF6D0gDVH+mnIjT
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2104 wrote to memory of 2132 2104 rundll32.exe 28 PID 2104 wrote to memory of 2132 2104 rundll32.exe 28 PID 2104 wrote to memory of 2132 2104 rundll32.exe 28 PID 2104 wrote to memory of 2132 2104 rundll32.exe 28 PID 2104 wrote to memory of 2132 2104 rundll32.exe 28 PID 2104 wrote to memory of 2132 2104 rundll32.exe 28 PID 2104 wrote to memory of 2132 2104 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9b7406dd2bd4a581271f4f2715d7d6c997e5766929c8fcc566972a70e5fd3405.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9b7406dd2bd4a581271f4f2715d7d6c997e5766929c8fcc566972a70e5fd3405.dll,#12⤵PID:2132
-