ddaa8930856619d828e7296684577e05ac655eafe657997cfae6463c03bb544a | Triage

Analysis

max time kernel
122s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 16:21

Sharing

Report Analysis Logs

General

Target

0567d2dd52a9470417a9f60e9f962a27.dll
Size

44KB
MD5

0567d2dd52a9470417a9f60e9f962a27
SHA1

6c9742e35f5e26831982de93cf64e3a6d12c81c8
SHA256

ddaa8930856619d828e7296684577e05ac655eafe657997cfae6463c03bb544a
SHA512

61e3cb03032287f398c6049a03a7a508830bcfb868b89741ea8e7119c99d1a827856fe1b63eb8e6b1b0f684cce0c740a74adbec83b12f2d92d80e20cc230443c
SSDEEP

768:lcsT+vcCmKwC7+4tAaHWieD16Nj48lbjxDCNalQe:lcKaDwC7+Lm14SxDKe

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 1820	2712	rundll32.exe	29
PID 2712 wrote to memory of 1820	2712	rundll32.exe	29
PID 2712 wrote to memory of 1820	2712	rundll32.exe	29
PID 2712 wrote to memory of 1820	2712	rundll32.exe	29
PID 2712 wrote to memory of 1820	2712	rundll32.exe	29
PID 2712 wrote to memory of 1820	2712	rundll32.exe	29
PID 2712 wrote to memory of 1820	2712	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0567d2dd52a9470417a9f60e9f962a27.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0567d2dd52a9470417a9f60e9f962a27.dll,#1
  2⤵
  PID:1820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads