6c611841f8150bff3266e0421a14b57c28c8767974adbd7e056db54162184934 | Triage

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
31/08/2023, 20:47

Sharing

Report Analysis Logs

General

Target

tpkcom.dll
Size

124KB
MD5

b5552cd1a82017b7ba485fdec07b5c59
SHA1

02e6a4bfa68852b9f25c3b6e57724436b1bccb82
SHA256

a7c996fcf8c1ba6cce06be0c73fb9c90931312206bb121ed43ba92964ba7e558
SHA512

a6d966175d5cfba64c76c51f146492224393256abdf19847f5c53746c597e73ae8d58e2ff959d9994462077d04ec6c4eaebbdef527ccd3a04bba139baf6e5692
SSDEEP

3072:29QnZ1fQCRheIJ3PTN+aRmJKy41JrVwKMOtx4:q0ZSQ3PPJrzp4

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2056	2256	rundll32.exe	28
PID 2256 wrote to memory of 2056	2256	rundll32.exe	28
PID 2256 wrote to memory of 2056	2256	rundll32.exe	28
PID 2256 wrote to memory of 2056	2256	rundll32.exe	28
PID 2256 wrote to memory of 2056	2256	rundll32.exe	28
PID 2256 wrote to memory of 2056	2256	rundll32.exe	28
PID 2256 wrote to memory of 2056	2256	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\tpkcom.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\tpkcom.dll,#1
  2⤵
  PID:2056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads