3d2df72e835b24e6ab7fad67457a9f86869b65c7c2731692b27dd6b9b94f37c7 | Triage

Analysis

max time kernel
120s
max time network
134s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 05:49

Sharing

Report Analysis Logs

General

Target

DetEven.dll
Size

1.3MB
MD5

2e14b8420adcf265bb65cefb081f454a
SHA1

bb7ddfc90b5e5995fd22cdd9706e6b77f4b9ea5b
SHA256

3d2df72e835b24e6ab7fad67457a9f86869b65c7c2731692b27dd6b9b94f37c7
SHA512

87adc058cdba45e9f3c5062bbc2d9931370d02c287cba29a6f85a27ab5ffbd3c932a23e571f3b11d21287a684edfa82c0947bf68ccf7f7c8a11df4e4dbf33cc8
SSDEEP

12288:9bvn5elqJVZLSSj/cez83VTHTpz4TOgQnD3QokzJpbOTri2s4gRtlWmTGVmE7GG7:97Pwfp7K4gRvW6Z7T6AV

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2364	3048	rundll32.exe	28
PID 3048 wrote to memory of 2364	3048	rundll32.exe	28
PID 3048 wrote to memory of 2364	3048	rundll32.exe	28
PID 3048 wrote to memory of 2364	3048	rundll32.exe	28
PID 3048 wrote to memory of 2364	3048	rundll32.exe	28
PID 3048 wrote to memory of 2364	3048	rundll32.exe	28
PID 3048 wrote to memory of 2364	3048	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DetEven.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DetEven.dll,#1
  2⤵
  PID:2364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads