7f8b1f53af9226bcec8964a3f493b8d64ca1446cd75e5ec0bc6777fe33fee4e7 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 05:06

Sharing

Report Analysis Logs

General

Target

06c33545ac144ff0c0655a364098483d.dll
Size

61KB
MD5

06c33545ac144ff0c0655a364098483d
SHA1

096c1d06fbe862920714b0df1229caf5d9cab5d4
SHA256

7f8b1f53af9226bcec8964a3f493b8d64ca1446cd75e5ec0bc6777fe33fee4e7
SHA512

2e836e6060821bf86ed90e8363497ba55650760e76469472e9e73d1e6fa67017f8009112182a0559aeb5bc0480bb2381eee74416d24a53987f05130a7b8e5572
SSDEEP

1536:qCOhvV3LWAxkjM9rh6jKHL3ziiq4efPgMt+kC:4h8BjMdJzfq4UFC

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 3012	2988	rundll32.exe	14
PID 2988 wrote to memory of 3012	2988	rundll32.exe	14
PID 2988 wrote to memory of 3012	2988	rundll32.exe	14
PID 2988 wrote to memory of 3012	2988	rundll32.exe	14
PID 2988 wrote to memory of 3012	2988	rundll32.exe	14
PID 2988 wrote to memory of 3012	2988	rundll32.exe	14
PID 2988 wrote to memory of 3012	2988	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06c33545ac144ff0c0655a364098483d.dll,#1
1⤵
PID:3012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\06c33545ac144ff0c0655a364098483d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads