3e1d7e5e13e689403cb9217ff3f4f31336642d479cf504a4d0837189520ff02e | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 17:45

Sharing

Report Analysis Logs

General

Target

0934cba0a5feb94237c67143fdfcd579.dll
Size

3KB
MD5

0934cba0a5feb94237c67143fdfcd579
SHA1

e5ae93e4feca55016f3a3b08e6f6fc96a7462195
SHA256

3e1d7e5e13e689403cb9217ff3f4f31336642d479cf504a4d0837189520ff02e
SHA512

f41e6efa4bd8f00ebf07870f2981ca0eba65ace196ce4142a96cfb3c0669855173d32b712c14ca168f1f562c1e79c71bb6e6dedc3978b3bf591c40b326f7f43a

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 2264	1336	rundll32.exe	14
PID 1336 wrote to memory of 2264	1336	rundll32.exe	14
PID 1336 wrote to memory of 2264	1336	rundll32.exe	14
PID 1336 wrote to memory of 2264	1336	rundll32.exe	14
PID 1336 wrote to memory of 2264	1336	rundll32.exe	14
PID 1336 wrote to memory of 2264	1336	rundll32.exe	14
PID 1336 wrote to memory of 2264	1336	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0934cba0a5feb94237c67143fdfcd579.dll,#1
1⤵
PID:2264

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0934cba0a5feb94237c67143fdfcd579.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads