cabf1949d6682f1c84140199ee44c838ddff5a08d25c2c5f6eb01bd2ac4bacde | Triage

Analysis

max time kernel
122s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 03:05

Sharing

Report Analysis Logs

General

Target

01cc65af7cbaa66b3e9ce63901848183.dll
Size

275KB
MD5

01cc65af7cbaa66b3e9ce63901848183
SHA1

6531570b1ebfa8c1f82fec979e5c757939e3e48b
SHA256

cabf1949d6682f1c84140199ee44c838ddff5a08d25c2c5f6eb01bd2ac4bacde
SHA512

92afe1de416c121d5f26303d1201592aea5c18254fc24eb6f0aca161742fb0691997262448b8d2083313ebaf11563b73e2f828f2128e22c9dafd2f0e2516c49c
SSDEEP

3072:JUb4Ok+0qGzca35CnD4vx8R05kdzmQnj:eb4Ok+mlpYD4c05RE

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 1488	2512	rundll32.exe	28
PID 2512 wrote to memory of 1488	2512	rundll32.exe	28
PID 2512 wrote to memory of 1488	2512	rundll32.exe	28
PID 2512 wrote to memory of 1488	2512	rundll32.exe	28
PID 2512 wrote to memory of 1488	2512	rundll32.exe	28
PID 2512 wrote to memory of 1488	2512	rundll32.exe	28
PID 2512 wrote to memory of 1488	2512	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01cc65af7cbaa66b3e9ce63901848183.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\01cc65af7cbaa66b3e9ce63901848183.dll,#1
  2⤵
  PID:1488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads