5642d1ae53a6dba7a084d997ca76305e40b897e90b1f7a932e08d980ea1a2ba0 | Triage

Analysis

max time kernel
29s
max time network
35s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
25/04/2023, 14:05

Sharing

Report Analysis Logs

General

Target

portable/_hashlib.dll
Size

993KB
MD5

b1dbd52e5da083e5b5613a2b4c17a4ef
SHA1

0ed87f9e0b572f88e102739daab54db03fade416
SHA256

fa57bf3173f2d636984305401c06f1618b8119fea2c311d1173566ea236fa0c6
SHA512

dbe14802ff53e8fb9f35baa1c1bd0dc55c1073e0f96b59b5cc3783760e23c645cd453a39b2b4d0ab79ee871ba1cb81154a4cf5c54b67dde7ea14008d72dd2cae
SSDEEP

24576:oQhOEvtEWiRLcoTUIEPmUsOE0iUadcBoO0kAB05bSpUYPGDqul:1lE74EUXrZ6O0kXSpUhDqul

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 1092	1664	rundll32.exe	28
PID 1664 wrote to memory of 1092	1664	rundll32.exe	28
PID 1664 wrote to memory of 1092	1664	rundll32.exe	28
PID 1664 wrote to memory of 1092	1664	rundll32.exe	28
PID 1664 wrote to memory of 1092	1664	rundll32.exe	28
PID 1664 wrote to memory of 1092	1664	rundll32.exe	28
PID 1664 wrote to memory of 1092	1664	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\portable\_hashlib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\portable\_hashlib.dll,#1
  2⤵
  PID:1092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads