0493885df976df60afb48aaa8b168d34dec8ca9a93f600f3536fa88bbe948dac | Triage

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 05:44

Sharing

Report Analysis Logs

General

Target

08fae01515fb299d0a632052b050a796.dll
Size

25KB
MD5

08fae01515fb299d0a632052b050a796
SHA1

b5f55790ba398f81a54889623db64c1ce377df94
SHA256

0493885df976df60afb48aaa8b168d34dec8ca9a93f600f3536fa88bbe948dac
SHA512

b86270096e437069a53d409b2debb58ceed0a61aeaedbbbba7f97e64974fc1e220bda39105b2d5dbfd2cbf61e50f20d11da5d4aded88c2dcad0dbcbec8e94e18
SSDEEP

768:94ZTvvQhRjbacva8F8SWfnGfS1XeX1XIEaXIEX:9YLQ/PachG/G6rELEX

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2404	1724	rundll32.exe	28
PID 1724 wrote to memory of 2404	1724	rundll32.exe	28
PID 1724 wrote to memory of 2404	1724	rundll32.exe	28
PID 1724 wrote to memory of 2404	1724	rundll32.exe	28
PID 1724 wrote to memory of 2404	1724	rundll32.exe	28
PID 1724 wrote to memory of 2404	1724	rundll32.exe	28
PID 1724 wrote to memory of 2404	1724	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\08fae01515fb299d0a632052b050a796.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\08fae01515fb299d0a632052b050a796.dll,#1
  2⤵
  PID:2404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2404-0-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download