82d5d82d9d2b7ff6ac7bf5e784c2be0630b7d3ff6d59fc159f71b7fd91b153d9 | Triage

Analysis

max time kernel
122s
max time network
139s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
15-10-2023 14:47

Sharing

Report Analysis Logs

General

Target

67df358b5dbe1fa8e8009585f1384ee0_dll32_JC.dll
Size

3KB
MD5

67df358b5dbe1fa8e8009585f1384ee0
SHA1

47fac8b926779b2271cd0f468b40bf5e6b2bbb5d
SHA256

82d5d82d9d2b7ff6ac7bf5e784c2be0630b7d3ff6d59fc159f71b7fd91b153d9
SHA512

77c27b8b95a5086c83209836bca6da4ba05f2b46ec4e6740aaf82a9c0133eb8645702f398a4fb8cd2c3093ab02b2c3d53b0c1a4e82707d117c7307798a1824e3

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 1724	2092	rundll32.exe	27
PID 2092 wrote to memory of 1724	2092	rundll32.exe	27
PID 2092 wrote to memory of 1724	2092	rundll32.exe	27
PID 2092 wrote to memory of 1724	2092	rundll32.exe	27
PID 2092 wrote to memory of 1724	2092	rundll32.exe	27
PID 2092 wrote to memory of 1724	2092	rundll32.exe	27
PID 2092 wrote to memory of 1724	2092	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\67df358b5dbe1fa8e8009585f1384ee0_dll32_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\67df358b5dbe1fa8e8009585f1384ee0_dll32_JC.dll,#1
  2⤵
  PID:1724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads