39ebf996ee711ba43b36772c745f82eb32e9cd70f85c31ce547dd9f0d52ddb50 | Triage

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 23:12

Sharing

Report Analysis Logs

General

Target

1878dcb96fab72d37ac4cfa290b578a2.dll
Size

452KB
MD5

1878dcb96fab72d37ac4cfa290b578a2
SHA1

14f348357af8e11f5b759631c98c7816e6f7e292
SHA256

39ebf996ee711ba43b36772c745f82eb32e9cd70f85c31ce547dd9f0d52ddb50
SHA512

30156519624b982867c2aac8aee7a71d0206b6bba312e7fd1142d5be228ca7eaeca7c902ca2fe84bef96452d8f23eb4fbc165291a80f4638949c475036f72ff3
SSDEEP

12288:OcFGNgk8c6elKiks8hEkpdYxx7W0fllchLMT:OcE6elkZExE0fl+w

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 1652	1984	rundll32.exe	28
PID 1984 wrote to memory of 1652	1984	rundll32.exe	28
PID 1984 wrote to memory of 1652	1984	rundll32.exe	28
PID 1984 wrote to memory of 1652	1984	rundll32.exe	28
PID 1984 wrote to memory of 1652	1984	rundll32.exe	28
PID 1984 wrote to memory of 1652	1984	rundll32.exe	28
PID 1984 wrote to memory of 1652	1984	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1878dcb96fab72d37ac4cfa290b578a2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1878dcb96fab72d37ac4cfa290b578a2.dll,#1
  2⤵
  PID:1652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1652-0-0x000000001E200000-0x000000001E27B000-memory.dmp

Filesize
492KB

Download
memory/1652-1-0x000000001E200000-0x000000001E27B000-memory.dmp

Filesize
492KB

Download