71589b35be287d13408c34045257c6648b8407ffb353f877fd9b54d69d3db69a | Triage

Analysis

max time kernel
57s
max time network
29s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 19:42

Sharing

Report Analysis Logs

General

Target

0e624fdb93b216d59cbe6866e3fb1976.dll
Size

7KB
MD5

0e624fdb93b216d59cbe6866e3fb1976
SHA1

19086133d6379fae2b846c6dcfd12aaf8f31e422
SHA256

71589b35be287d13408c34045257c6648b8407ffb353f877fd9b54d69d3db69a
SHA512

914cabd25863d1780718bd1d760462fce501977c81602963a53c5656014b84337473d92c87cc630bbbb51deabc044cc678de2b26d2da1e729ebdeef3064a9759
SSDEEP

192:Dd2SpT4GaAtljf5UBqPnH5L51xhWUyptOvLnvjkgUwub:DN4+BqknZ51f0ILn09

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2692	2656	rundll32.exe	29
PID 2656 wrote to memory of 2692	2656	rundll32.exe	29
PID 2656 wrote to memory of 2692	2656	rundll32.exe	29
PID 2656 wrote to memory of 2692	2656	rundll32.exe	29
PID 2656 wrote to memory of 2692	2656	rundll32.exe	29
PID 2656 wrote to memory of 2692	2656	rundll32.exe	29
PID 2656 wrote to memory of 2692	2656	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e624fdb93b216d59cbe6866e3fb1976.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e624fdb93b216d59cbe6866e3fb1976.dll,#1
  2⤵
  PID:2692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2692-0-0x0000000015000000-0x0000000015011000-memory.dmp

Filesize
68KB

Download
memory/2692-1-0x0000000015000000-0x0000000015011000-memory.dmp

Filesize
68KB

Download