aee5b92a7c58164f5a42cbd3c605251c73480e197737eed2a208b71be3a0f1eb | Triage

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 05:59

Sharing

Report Analysis Logs

General

Target

09e4d0765a38f6c532e0909e3950a3ce.dll
Size

3KB
MD5

09e4d0765a38f6c532e0909e3950a3ce
SHA1

8ac9e53de86582f479a3254726d5dd70e79bd559
SHA256

aee5b92a7c58164f5a42cbd3c605251c73480e197737eed2a208b71be3a0f1eb
SHA512

9756941083fd6e049be92d4eb05197af54cbbce3756ebff1c23a606a651f0747a619b963de228c4af357a2c6cc52bdd6bbbb5451e91917928b9523c658535f72

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 2280	812	rundll32.exe	28
PID 812 wrote to memory of 2280	812	rundll32.exe	28
PID 812 wrote to memory of 2280	812	rundll32.exe	28
PID 812 wrote to memory of 2280	812	rundll32.exe	28
PID 812 wrote to memory of 2280	812	rundll32.exe	28
PID 812 wrote to memory of 2280	812	rundll32.exe	28
PID 812 wrote to memory of 2280	812	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\09e4d0765a38f6c532e0909e3950a3ce.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\09e4d0765a38f6c532e0909e3950a3ce.dll,#1
  2⤵
  PID:2280

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads