93d1df69e244cae0eeec8a6422e70fa404a5227907e93cdb06eec97c5f4f155a | Triage

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 14:13

Sharing

Report Analysis Logs

General

Target

bb38811767f42635a13b56afd5bbace7.dll
Size

152KB
MD5

bb38811767f42635a13b56afd5bbace7
SHA1

291f9b8b1075f0b97c7bdeb1e27a4358a5d08e96
SHA256

93d1df69e244cae0eeec8a6422e70fa404a5227907e93cdb06eec97c5f4f155a
SHA512

5ae6111bdaa1741ff318e8fe44f89125d610f902b46660a8c02c76132d8c9fd8b4d48503d1dfb86476e0a1347d3d6b39446d86f7ab5d30c9d7d083dd3943aebb
SSDEEP

3072:3hSOaj9fCvequz+4dHZtRMRmjLygGyH21qFo9eN:xJqR+4VZt2RmnyBH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 1288	2208	rundll32.exe	28
PID 2208 wrote to memory of 1288	2208	rundll32.exe	28
PID 2208 wrote to memory of 1288	2208	rundll32.exe	28
PID 2208 wrote to memory of 1288	2208	rundll32.exe	28
PID 2208 wrote to memory of 1288	2208	rundll32.exe	28
PID 2208 wrote to memory of 1288	2208	rundll32.exe	28
PID 2208 wrote to memory of 1288	2208	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb38811767f42635a13b56afd5bbace7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb38811767f42635a13b56afd5bbace7.dll,#1
  2⤵
  PID:1288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads