5be23f566a10efa1d62466a4cb5fa1773dc318e14348077b080a59cdf9836a3e | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 22:50

Sharing

Report Analysis Logs

General

Target

17130f97a0b6508cec7a71610f8bc39f.dll
Size

3KB
MD5

17130f97a0b6508cec7a71610f8bc39f
SHA1

d61fdb83677c0af9376e42b159f7ab22326e4a24
SHA256

5be23f566a10efa1d62466a4cb5fa1773dc318e14348077b080a59cdf9836a3e
SHA512

7e02e6a61e6220f1b2c4dfc5bd4c5dd861fb5acca06a8c2d129a794a1d0a665a28fa03816e1367b5c310275156af7840610ac4c7bf6f5fe1ab91d35e81e28b66

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 2928	1300	rundll32.exe	28
PID 1300 wrote to memory of 2928	1300	rundll32.exe	28
PID 1300 wrote to memory of 2928	1300	rundll32.exe	28
PID 1300 wrote to memory of 2928	1300	rundll32.exe	28
PID 1300 wrote to memory of 2928	1300	rundll32.exe	28
PID 1300 wrote to memory of 2928	1300	rundll32.exe	28
PID 1300 wrote to memory of 2928	1300	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\17130f97a0b6508cec7a71610f8bc39f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\17130f97a0b6508cec7a71610f8bc39f.dll,#1
  2⤵
  PID:2928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads