d7328efeb259c12686d5797c9abcf0fad794ca7b9361f0517027c71b58b42347 | Triage

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
06/08/2023, 02:33

Sharing

Report Analysis Logs

General

Target

sock.dll
Size

40KB
MD5

71f62c3fa63521b90bcec93d988eea7d
SHA1

9abf04048357b03481b40d8aeb4fbc995f6c5c28
SHA256

dc64aefb6fbb939a8da4dd37ef8eb9ae324285546347bc1a130d73a6f60ac55d
SHA512

8d31026777e6a94d179045650dc283be0c31dbed9c512ff1318316b190ae9806293d31939ca348639b41d07eaf2723281740071a941737484c2dc7cce8b4d94f
SSDEEP

768:NciLzYKk9V8ak8E9eT/5jziXkzfTo96oth:SKk78aI9eTRzKkfot

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2896	2292	rundll32.exe	28
PID 2292 wrote to memory of 2896	2292	rundll32.exe	28
PID 2292 wrote to memory of 2896	2292	rundll32.exe	28
PID 2292 wrote to memory of 2896	2292	rundll32.exe	28
PID 2292 wrote to memory of 2896	2292	rundll32.exe	28
PID 2292 wrote to memory of 2896	2292	rundll32.exe	28
PID 2292 wrote to memory of 2896	2292	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\sock.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\sock.dll,#1
  2⤵
  PID:2896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads