31face2e8ed8c469650db07b8296f9c828f09f2339b6064bb0ff04ae235a1d09 | Triage

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 16:02

Sharing

Report Analysis Logs

General

Target

04bfdefb12cdfb3cdaaf6bc5a5c4664f.dll
Size

3KB
MD5

04bfdefb12cdfb3cdaaf6bc5a5c4664f
SHA1

053fc126b6ae58ff2412a09d93b3b24f6501949b
SHA256

31face2e8ed8c469650db07b8296f9c828f09f2339b6064bb0ff04ae235a1d09
SHA512

6a2a068e7000b4d2ac04302662203148d27db13c7a789a1e8ff42cabf4297b24d15782efc732d3877131c9e8d6e91f64b80d3afa32bcecd3c7094753875df9d7

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2452	3012	rundll32.exe	28
PID 3012 wrote to memory of 2452	3012	rundll32.exe	28
PID 3012 wrote to memory of 2452	3012	rundll32.exe	28
PID 3012 wrote to memory of 2452	3012	rundll32.exe	28
PID 3012 wrote to memory of 2452	3012	rundll32.exe	28
PID 3012 wrote to memory of 2452	3012	rundll32.exe	28
PID 3012 wrote to memory of 2452	3012	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\04bfdefb12cdfb3cdaaf6bc5a5c4664f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\04bfdefb12cdfb3cdaaf6bc5a5c4664f.dll,#1
  2⤵
  PID:2452

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads