4ffc7f65e16ce59ff9e6a504f88e0cf56b225c0eb2cf8ec578b3e9d40d9bd898 | Triage

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
12-04-2023 03:48

Sharing

Report Analysis Logs

General

Target

abbe7d13b13ea4315543bdad187f14b3.dll
Size

126KB
MD5

abbe7d13b13ea4315543bdad187f14b3
SHA1

11b82826ec01aeec44e5e2504935b6aaccf51cac
SHA256

4ffc7f65e16ce59ff9e6a504f88e0cf56b225c0eb2cf8ec578b3e9d40d9bd898
SHA512

16776e72d0c8e304a355967caa9150b918ad0648cab860852c6907eaa60ecd321630ce871c89ad882df334bb1c54e9912d510af5bdc6cae5a93620a4e0090f62
SSDEEP

3072:0aZyNykBgIGsU4jfIwcy8MzmRU6cj6/m0CypHb3:0aZyNyHJ4jNd8ry6K6Dj

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2020	2008	rundll32.exe	28
PID 2008 wrote to memory of 2020	2008	rundll32.exe	28
PID 2008 wrote to memory of 2020	2008	rundll32.exe	28
PID 2008 wrote to memory of 2020	2008	rundll32.exe	28
PID 2008 wrote to memory of 2020	2008	rundll32.exe	28
PID 2008 wrote to memory of 2020	2008	rundll32.exe	28
PID 2008 wrote to memory of 2020	2008	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\abbe7d13b13ea4315543bdad187f14b3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\abbe7d13b13ea4315543bdad187f14b3.dll,#1
  2⤵
  PID:2020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads