8df045a1d8b3b22bd730b71bc64c937f86e11e10fc71fb6f1450662799b72486 | Triage

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 23:38

Sharing

Report Analysis Logs

General

Target

1a2996a2c196dddaf043b62ce6c1fd94.dll
Size

50KB
MD5

1a2996a2c196dddaf043b62ce6c1fd94
SHA1

6d0267f9af140542acce1cf950d1e7cbcb27c59e
SHA256

8df045a1d8b3b22bd730b71bc64c937f86e11e10fc71fb6f1450662799b72486
SHA512

460cc58a6433becd6d26fe33bf7372595b323c6c57f4aaea5b2ced8a27892ac295e0ce7460bf3ffcbd62e0d43fcb31cd5ea9477bfa8968eb54125d41f3f5455b
SSDEEP

768:IQWvgQYLCPJiSXj3PLle9UCvK1u6rkR7rH1db:CJYLs8GHle9ZS4dR7b

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2664	2548	rundll32.exe	28
PID 2548 wrote to memory of 2664	2548	rundll32.exe	28
PID 2548 wrote to memory of 2664	2548	rundll32.exe	28
PID 2548 wrote to memory of 2664	2548	rundll32.exe	28
PID 2548 wrote to memory of 2664	2548	rundll32.exe	28
PID 2548 wrote to memory of 2664	2548	rundll32.exe	28
PID 2548 wrote to memory of 2664	2548	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a2996a2c196dddaf043b62ce6c1fd94.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a2996a2c196dddaf043b62ce6c1fd94.dll,#1
  2⤵
  PID:2664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2664-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2664-1-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download