d6c4395f0ae44000bacfd6e32934f039172d50b88f800e91632aa28224e49062 | Triage

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13/10/2023, 23:25

Sharing

Report Analysis Logs

General

Target

Module.dll
Size

5.6MB
MD5

456512be55e64adc06604a8ca754a4c1
SHA1

91f6ca205bec76561b34be0f8bc53882d3bac847
SHA256

906f70118cf49eb59f01981ece40b9669ee37d934482c982ae887fa0b5bbea5b
SHA512

e322c0c3a3ea5ff4d0e15458680771130b397bea9b132656710eaed706ce29fa923ff752ef5c05433fb047a356d106bbc518958d86c4be00b09db93924be819a
SSDEEP

98304:TS6C/Lx97QIj+5B2EyYkvR8/lgQ/6SRJ9vN:TaLvnvvGnF

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 1688	1304	rundll32.exe	28
PID 1304 wrote to memory of 1688	1304	rundll32.exe	28
PID 1304 wrote to memory of 1688	1304	rundll32.exe	28
PID 1304 wrote to memory of 1688	1304	rundll32.exe	28
PID 1304 wrote to memory of 1688	1304	rundll32.exe	28
PID 1304 wrote to memory of 1688	1304	rundll32.exe	28
PID 1304 wrote to memory of 1688	1304	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Module.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Module.dll,#1
  2⤵
  PID:1688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads