29ff4db31c821189775f54d3b0ff8c2ecc29535c39b8ee9a6f765a114e8631dc | Triage

Analysis

max time kernel
118s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 15:13

Sharing

Report Analysis Logs

General

Target

033fafa9a3dcb8de5a349d05784fa70f.dll
Size

3KB
MD5

033fafa9a3dcb8de5a349d05784fa70f
SHA1

2611a8502d0e295f7c30f549e5381945072066ee
SHA256

29ff4db31c821189775f54d3b0ff8c2ecc29535c39b8ee9a6f765a114e8631dc
SHA512

5dc3ecb5c7ed716520e453d25ddd2a0a28b14414a3e02edd5a51cbdb26dbc46f1a9902e78bae76b999f224a6bfa18ce4c47a3252c288a51ecc1e62a311e79e33

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2284	2092	rundll32.exe	16
PID 2092 wrote to memory of 2284	2092	rundll32.exe	16
PID 2092 wrote to memory of 2284	2092	rundll32.exe	16
PID 2092 wrote to memory of 2284	2092	rundll32.exe	16
PID 2092 wrote to memory of 2284	2092	rundll32.exe	16
PID 2092 wrote to memory of 2284	2092	rundll32.exe	16
PID 2092 wrote to memory of 2284	2092	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\033fafa9a3dcb8de5a349d05784fa70f.dll,#1
1⤵
PID:2284

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\033fafa9a3dcb8de5a349d05784fa70f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads