429ee2644a693084be60d9a1198036c81d5e2fe2289fbb0db9b4d24751580ad1 | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 17:20

Sharing

Report Analysis Logs

General

Target

081a2cf2b55663ab57eb41eeecc1e03d.dll
Size

98KB
MD5

081a2cf2b55663ab57eb41eeecc1e03d
SHA1

09479d3abd41f1b284b94d19b93f35af54b95dec
SHA256

429ee2644a693084be60d9a1198036c81d5e2fe2289fbb0db9b4d24751580ad1
SHA512

d6f1582d4daa3ba6ea3ecf92224e0378fa8822968182148f491d2806fd1e066a36382bca88ac1978b65f722c1c1cda46fe1f3ca851c309a653d5a30c1ce25fbd
SSDEEP

3072:vL7ijM0KG0b437pV4BqDSZk0sdra2symfSlo8:jWRKVb43qaaRT1fSlp

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 2800	2904	rundll32.exe	14
PID 2904 wrote to memory of 2800	2904	rundll32.exe	14
PID 2904 wrote to memory of 2800	2904	rundll32.exe	14
PID 2904 wrote to memory of 2800	2904	rundll32.exe	14
PID 2904 wrote to memory of 2800	2904	rundll32.exe	14
PID 2904 wrote to memory of 2800	2904	rundll32.exe	14
PID 2904 wrote to memory of 2800	2904	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\081a2cf2b55663ab57eb41eeecc1e03d.dll,#1
1⤵
PID:2800

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\081a2cf2b55663ab57eb41eeecc1e03d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2800-2-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download
memory/2800-1-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download
memory/2800-0-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download