d3a0cb879001f164b9c569ab6d94ac29c06065dcd7fdb0a49544f39a42072d6b | Triage

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 19:53

Sharing

Report Analysis Logs

General

Target

0f0ad35759641dc37d857ade3d889fb5.dll
Size

98KB
MD5

0f0ad35759641dc37d857ade3d889fb5
SHA1

1b673a70483d80b124030dd304e2614899f9b46f
SHA256

d3a0cb879001f164b9c569ab6d94ac29c06065dcd7fdb0a49544f39a42072d6b
SHA512

a17716864f0fb211b1f60c6632698b94bf359ccd6cd82094735feb2389f86678a43953bbab4f056e6d3e1b00e2ee50efa445c87198fe1fdbc8fe80425490e400
SSDEEP

3072:ilEYMEAH0jrUwMa+leeOjIpSfe3amx0VzV:ilE+vgwMvleeeq2Cam+VR

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2720	2028	rundll32.exe	28
PID 2028 wrote to memory of 2720	2028	rundll32.exe	28
PID 2028 wrote to memory of 2720	2028	rundll32.exe	28
PID 2028 wrote to memory of 2720	2028	rundll32.exe	28
PID 2028 wrote to memory of 2720	2028	rundll32.exe	28
PID 2028 wrote to memory of 2720	2028	rundll32.exe	28
PID 2028 wrote to memory of 2720	2028	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f0ad35759641dc37d857ade3d889fb5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f0ad35759641dc37d857ade3d889fb5.dll,#1
  2⤵
  PID:2720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2720-0-0x00000000007D0000-0x00000000008D9000-memory.dmp

Filesize
1.0MB

Download
memory/2720-2-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download
memory/2720-1-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download
memory/2720-3-0x00000000007D0000-0x00000000008D9000-memory.dmp

Filesize
1.0MB

Download