Analysis

  • max time kernel
    40s
  • max time network
    43s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    19/11/2022, 04:50

General

  • Target

    eff78d4e8c3750f7c16d00417cf601f8e9efb1c258373b4139860fd37be883d9.dll

  • Size

    72KB

  • MD5

    2585c0fe09d2f03a82dae7a18e76b9af

  • SHA1

    63f4bff1c9fa6ee0f493b3db7f8b93f0cd09e22c

  • SHA256

    eff78d4e8c3750f7c16d00417cf601f8e9efb1c258373b4139860fd37be883d9

  • SHA512

    33a7b10e5f2d1fa0d41be38085c33500b7a3a6f9a079fc11a4225d72406afd51839cbb60dd52c2e7e8c230490f11b243b8e001b757e3900c0e96561c39f34398

  • SSDEEP

    1536:QstOC7PazOFn058YaUxwjYi+GhOambg5pRDi6gcW:NNIxwjhubyDiMW

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\eff78d4e8c3750f7c16d00417cf601f8e9efb1c258373b4139860fd37be883d9.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1504
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\eff78d4e8c3750f7c16d00417cf601f8e9efb1c258373b4139860fd37be883d9.dll,#1
      2⤵
        PID:1460

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1460-55-0x00000000768A1000-0x00000000768A3000-memory.dmp

            Filesize

            8KB

          • memory/1460-56-0x00000000001C0000-0x00000000001EB000-memory.dmp

            Filesize

            172KB

          • memory/1460-57-0x00000000001C0000-0x00000000001EB000-memory.dmp

            Filesize

            172KB

          • memory/1460-59-0x00000000001C0000-0x00000000001EB000-memory.dmp

            Filesize

            172KB

          • memory/1460-58-0x00000000001C0000-0x00000000001EB000-memory.dmp

            Filesize

            172KB

          • memory/1460-60-0x00000000001C0000-0x00000000001EB000-memory.dmp

            Filesize

            172KB

          • memory/1460-61-0x00000000001C0000-0x00000000001EB000-memory.dmp

            Filesize

            172KB

          • memory/1460-62-0x00000000001C0000-0x00000000001EB000-memory.dmp

            Filesize

            172KB

          • memory/1460-63-0x00000000001C0000-0x00000000001C2000-memory.dmp

            Filesize

            8KB