dc97cc7596d08891a0f4f1fc842854df0cf10566553d9e1c4393c34e6fd1bdc4 | Triage

Analysis

max time kernel
119s
max time network
132s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 16:02

Sharing

Report Analysis Logs

General

Target

780c1781624a4b693fd1811feec3f5d6.dll
Size

1.2MB
MD5

780c1781624a4b693fd1811feec3f5d6
SHA1

8e5c51b9f7a9ec5b83923ef0b343674b8aeceb8e
SHA256

dc97cc7596d08891a0f4f1fc842854df0cf10566553d9e1c4393c34e6fd1bdc4
SHA512

ccefd37250667bc416bc320da22ff5ddd084af07e56cf76c352de09f206c796dd6d4ea7884f0e0554e8ba59b630c7b67f6100328c6679a87c990861a4222b825
SSDEEP

24576:3C7CI9TZDEWk1wCy0zaG9cQA31ftxmbfYQJZKC0D:7I99DEWVtQA3Zmn0P

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 2196	1444	rundll32.exe	28
PID 1444 wrote to memory of 2196	1444	rundll32.exe	28
PID 1444 wrote to memory of 2196	1444	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\780c1781624a4b693fd1811feec3f5d6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1444 -s 56
  2⤵
  PID:2196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads