Analysis
-
max time kernel
97s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
15/07/2024, 00:58
Static task
static1
Behavioral task
behavioral1
Sample
51a279222ea55abed1a78cba857175a0N.dll
Resource
win7-20240704-en
2 signatures
120 seconds
Behavioral task
behavioral2
Sample
51a279222ea55abed1a78cba857175a0N.dll
Resource
win10v2004-20240709-en
2 signatures
120 seconds
General
-
Target
51a279222ea55abed1a78cba857175a0N.dll
-
Size
2.2MB
-
MD5
51a279222ea55abed1a78cba857175a0
-
SHA1
14fe181a8519f288fa0365fd763a0cde6ae4d031
-
SHA256
01ce406541ad8301523e415a187da19c4f254a90b9e18e02aea95de432792ba6
-
SHA512
38511f85f9bce59990c7ed25a8f81659203bd510ff1402cf0ef855e342ada7e97d173b29cafc6a03814cc8491fc40160284bfc684579b605fc12a8a6ae40a9e2
-
SSDEEP
49152:5WCJfI760+dYUJUNlynyhKHIYchj7xevOdD7XZX2xx:YCl2+qc3yhzjevqD7Xx8x
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 32 4724 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1552 wrote to memory of 4724 1552 rundll32.exe 83 PID 1552 wrote to memory of 4724 1552 rundll32.exe 83 PID 1552 wrote to memory of 4724 1552 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\51a279222ea55abed1a78cba857175a0N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\51a279222ea55abed1a78cba857175a0N.dll,#12⤵
- Blocklisted process makes network request
PID:4724
-