27c1d590c82b7756fadbbba4f4d8e7ac4ef090fa88c8a37b01e82dddac569f50 | Triage

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
05-12-2023 16:30

Sharing

Report Analysis Logs

General

Target

92adfbe29d3ddd3afe816ca7e6f183bb.dll
Size

102KB
MD5

92adfbe29d3ddd3afe816ca7e6f183bb
SHA1

8e6868f4784fa663b11e7c2f17281e1aec48a84c
SHA256

27c1d590c82b7756fadbbba4f4d8e7ac4ef090fa88c8a37b01e82dddac569f50
SHA512

9a329727229d624241d14ab206219f2fad29125ec5fb2f1a332dd2832198382229eca03bdcf435563dcd3a121a8e96aa4648ea77704954a62bf4e88b6cdac68e
SSDEEP

3072:gWlRooD+MzxG2Mosm5quQR5yyrz7BUKBYW0Z:gc2l0RsIquQR5vdCW0Z

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3032 wrote to memory of 2180	3032	rundll32.exe	rundll32.exe
PID 3032 wrote to memory of 2180	3032	rundll32.exe	rundll32.exe
PID 3032 wrote to memory of 2180	3032	rundll32.exe	rundll32.exe
PID 3032 wrote to memory of 2180	3032	rundll32.exe	rundll32.exe
PID 3032 wrote to memory of 2180	3032	rundll32.exe	rundll32.exe
PID 3032 wrote to memory of 2180	3032	rundll32.exe	rundll32.exe
PID 3032 wrote to memory of 2180	3032	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\92adfbe29d3ddd3afe816ca7e6f183bb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3032

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\92adfbe29d3ddd3afe816ca7e6f183bb.dll,#1
2⤵
PID:2180

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...