568b7936c3c261e50cdaa536984a17b5bfbb2a221c31b503f62c3151006f58b5 | Triage

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 03:17

Sharing

Report Analysis Logs

General

Target

02714617f7c023c55cd083e2cac65730.dll
Size

6KB
MD5

02714617f7c023c55cd083e2cac65730
SHA1

25973546a84174ca00871dca60512a7f44a41faf
SHA256

568b7936c3c261e50cdaa536984a17b5bfbb2a221c31b503f62c3151006f58b5
SHA512

c1a1eed2f8cd9d6bd15b5e1e6fe49242fb803a34c358d7d4355f2df3e29aa96781e17502f4b144007c89dcfde3b5cfede7db606d0f3890cf8db48c8b1b1a54f2
SSDEEP

48:6EQt5YVOSVVEPy+wEMmqiHNpU100B+BDq9J5SV3DY:CSVVEPozmB7eB+FqX5S1D

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2180	2156	rundll32.exe	28
PID 2156 wrote to memory of 2180	2156	rundll32.exe	28
PID 2156 wrote to memory of 2180	2156	rundll32.exe	28
PID 2156 wrote to memory of 2180	2156	rundll32.exe	28
PID 2156 wrote to memory of 2180	2156	rundll32.exe	28
PID 2156 wrote to memory of 2180	2156	rundll32.exe	28
PID 2156 wrote to memory of 2180	2156	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\02714617f7c023c55cd083e2cac65730.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\02714617f7c023c55cd083e2cac65730.dll,#1
  2⤵
  PID:2180

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads