Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07/09/2024, 18:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0912658781c822ae5cdf5099162c6520N.dll
Resource
win7-20240903-en
2 signatures
120 seconds
Behavioral task
behavioral2
Sample
0912658781c822ae5cdf5099162c6520N.dll
Resource
win10v2004-20240802-en
1 signatures
120 seconds
General
-
Target
0912658781c822ae5cdf5099162c6520N.dll
-
Size
436KB
-
MD5
0912658781c822ae5cdf5099162c6520
-
SHA1
e84dc09ca126b4f0cc7424e28dcd6e9edf13ea4e
-
SHA256
0e76583f0e75bcc9f61bbc3163e694042e9afa5c9ab71cadc6df85f27450360e
-
SHA512
dc8f2daec2798bc8ce82135eb2b426ac61d37c5d60cbafebb299bd155069f0674f8f4a93ff48025305988f99690d1a65b4e5b5d7905d21a80f42b0b61fd870b2
-
SSDEEP
6144:IBr/zRnWyo5X/9aH/9att6tcwTpz0kA2AYSJ0GDkLTtVJfJh4QqUlqoIauZWk3Bg:IBHRnWyoy2sY0OpPkILEd+x
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2080 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2080 wrote to memory of 1864 2080 rundll32.exe 30 PID 2080 wrote to memory of 1864 2080 rundll32.exe 30 PID 2080 wrote to memory of 1864 2080 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0912658781c822ae5cdf5099162c6520N.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2080 -s 1442⤵PID:1864
-