22984927d3b2a70ed81cd085dbeba4cdbaaae8ce48911bbee4577679a956f4a1 | Triage

Analysis

max time kernel
118s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 01:22

Sharing

Report Analysis Logs

General

Target

202518893e75b49bc43ea7d0a4e8ffd6.dll
Size

1.0MB
MD5

202518893e75b49bc43ea7d0a4e8ffd6
SHA1

d70ce6464585abefd04c356f5a3cc7ef155e126c
SHA256

22984927d3b2a70ed81cd085dbeba4cdbaaae8ce48911bbee4577679a956f4a1
SHA512

4dbe4d7fd2b4c4b67d8b80c4f59577225c539f8e4899a2baf10b8963d10ea55e3655e71a897f336328b58ba9ce947aff74bb393b038fb3109a10946e98fcda88
SSDEEP

24576:Wfy3LomxjRr0qlu+pS0+M3tb0pvaep5Z7BKb:RUmNVPu/0J3tCieDqb

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2796	2860	rundll32.exe	29
PID 2860 wrote to memory of 2796	2860	rundll32.exe	29
PID 2860 wrote to memory of 2796	2860	rundll32.exe	29
PID 2860 wrote to memory of 2796	2860	rundll32.exe	29
PID 2860 wrote to memory of 2796	2860	rundll32.exe	29
PID 2860 wrote to memory of 2796	2860	rundll32.exe	29
PID 2860 wrote to memory of 2796	2860	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\202518893e75b49bc43ea7d0a4e8ffd6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\202518893e75b49bc43ea7d0a4e8ffd6.dll,#1
  2⤵
  PID:2796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads