4cbfa2bd0947022b000616c3aa9b4962c87a9d3b7aceae14f22a94ff756f4d6d | Triage

Analysis

max time kernel
26s
max time network
32s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
18/05/2023, 13:41

Sharing

Report Analysis Logs

General

Target

1337.dll
Size

1014KB
MD5

e0d7910c702f92d01c71e52820521bca
SHA1

4e116178d0d997f70a62574eae8d27c30f0a1c20
SHA256

4cbfa2bd0947022b000616c3aa9b4962c87a9d3b7aceae14f22a94ff756f4d6d
SHA512

90fc6e0881ee6afb2033dfd5e0524c6385627a52f07a200b66dfb41eef124e61d866e4385c20748ca9047df3f7ac3778c5116ac1c2fc69da277c57456543a71b
SSDEEP

12288:UjYxnjXcBIlezoQy41hY1eOuQxb64XpyUJM64eMr4JlMxx8Q484xvVAc+IFJNp:UUpcBSf4IeOlbrooi4JluqMQd

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 1232	1616	rundll32.exe	19
PID 1616 wrote to memory of 1232	1616	rundll32.exe	19
PID 1616 wrote to memory of 1232	1616	rundll32.exe	19
PID 1616 wrote to memory of 1232	1616	rundll32.exe	19
PID 1616 wrote to memory of 1232	1616	rundll32.exe	19
PID 1616 wrote to memory of 1232	1616	rundll32.exe	19
PID 1616 wrote to memory of 1232	1616	rundll32.exe	19

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1337.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1337.dll,#1
  2⤵
  PID:1232

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads