bdc5a1cf991cf18ad72ddd7ce05ad26b9bc5563e8ee80ec3ba9e644db6fe53bf | Triage

Analysis

max time kernel
118s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 03:31

Sharing

Report Analysis Logs

General

Target

033810b36c9f01677a5e450044ee9325.dll
Size

406KB
MD5

033810b36c9f01677a5e450044ee9325
SHA1

afc88f4cead9e5a10a472a2491b9d92ad6b2205f
SHA256

bdc5a1cf991cf18ad72ddd7ce05ad26b9bc5563e8ee80ec3ba9e644db6fe53bf
SHA512

3817b376b9df63604aa754ccff3739fc87d94b5ceb469f9df407ed1f08bae33d1719b68b81b1c2cfd4a1db4318f88a0cfdb858f6145f22996c9f85615f5aaf84
SSDEEP

12288:zWewL/wxCQcO4Q9etbdaeGWZYKqqKysqMBi29:zW8w24QybdSUJqq2Bz9

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2132	rundll32.exe
2132	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2132	2160	rundll32.exe	28
PID 2160 wrote to memory of 2132	2160	rundll32.exe	28
PID 2160 wrote to memory of 2132	2160	rundll32.exe	28
PID 2160 wrote to memory of 2132	2160	rundll32.exe	28
PID 2160 wrote to memory of 2132	2160	rundll32.exe	28
PID 2160 wrote to memory of 2132	2160	rundll32.exe	28
PID 2160 wrote to memory of 2132	2160	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\033810b36c9f01677a5e450044ee9325.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\033810b36c9f01677a5e450044ee9325.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2132

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2132-0-0x0000000001BB0000-0x0000000001C14000-memory.dmp

Filesize
400KB

Download