791373cad86a6bb9ecfae5e3eaacb215cfddc0257d9f757b2c4374fb642b23e7 | Triage

Analysis

max time kernel
7s
max time network
48s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
08/10/2023, 01:21

Sharing

Report Analysis Logs

General

Target

339993e68708980d24874ffc8172ca04.dll
Size

1.2MB
MD5

339993e68708980d24874ffc8172ca04
SHA1

9100332fcdbc458d0fc2e132b9a2a9195f63111e
SHA256

791373cad86a6bb9ecfae5e3eaacb215cfddc0257d9f757b2c4374fb642b23e7
SHA512

5c628ea2f8fb5a2befce2ecb5a8a579d7d012fcca7aeb25fc530e63b3e61ce373899cd7da485b62bf6f43caee647daffcc7646c8fef3a6dbe69340ccab5ce5e8
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQAK1ftxmbfYQJZKmcB:7I99DEWVtQAKZmn0z

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 2092	2140	rundll32.exe	28
PID 2140 wrote to memory of 2092	2140	rundll32.exe	28
PID 2140 wrote to memory of 2092	2140	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\339993e68708980d24874ffc8172ca04.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2140 -s 56
  2⤵
  PID:2092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads