0c79397158fc97d5422d60d42ce07f321803c535eaff888b37f971686dc0f912 | Triage

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
02/05/2023, 18:08

Sharing

Report Analysis Logs

General

Target

401_.dll
Size

320KB
MD5

22a8c03fb6e3e12a19ca25fbfb2421ea
SHA1

e6c5479cd482cf88c519d3d9f08511a11f58d531
SHA256

0c79397158fc97d5422d60d42ce07f321803c535eaff888b37f971686dc0f912
SHA512

d8b3b7b1ba007f403699805002cd8b17270b2ed5bbb9598b254a5eb7436f904c997e27a077e9e1ef875f8e0273f140bbe1fffa275a43c7558800f3f362f0be90
SSDEEP

6144:IynKe1U6ybW6cShRZuWYteU/0luNwOGJptI+hLb4LGSKoJ/5LvV:ICjOi6DuRltOEGLELGSXzz

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 1424	1436	rundll32.exe	28
PID 1436 wrote to memory of 1424	1436	rundll32.exe	28
PID 1436 wrote to memory of 1424	1436	rundll32.exe	28
PID 1436 wrote to memory of 1424	1436	rundll32.exe	28
PID 1436 wrote to memory of 1424	1436	rundll32.exe	28
PID 1436 wrote to memory of 1424	1436	rundll32.exe	28
PID 1436 wrote to memory of 1424	1436	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\401_.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\401_.dll,#1
  2⤵
  PID:1424

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads