7fba2672f614c11d89b7660a877b966dc1d9919b6f270b546fa7143a51463b07 | Triage

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 07:00

Sharing

Report Analysis Logs

General

Target

0d4859ffc6536a258a0bd38a7468d3d4.dll
Size

66KB
MD5

0d4859ffc6536a258a0bd38a7468d3d4
SHA1

f500707e2caf45d55b16c80005b7fc308b3adaeb
SHA256

7fba2672f614c11d89b7660a877b966dc1d9919b6f270b546fa7143a51463b07
SHA512

ad43e52b01932d2f41c29297f6b52435096c4e01a76cae415294fecebb89ad4b4915e7de775b97a204cf522e599fdd2803a84e7bc1aa28162b8aa198ddc8cb00
SSDEEP

1536:xvb3+yiMDlbdbBfsbN7Fc+hf4lUOKr77j:VPielBfsbQmQUnrj

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2292	2276	rundll32.exe	28
PID 2276 wrote to memory of 2292	2276	rundll32.exe	28
PID 2276 wrote to memory of 2292	2276	rundll32.exe	28
PID 2276 wrote to memory of 2292	2276	rundll32.exe	28
PID 2276 wrote to memory of 2292	2276	rundll32.exe	28
PID 2276 wrote to memory of 2292	2276	rundll32.exe	28
PID 2276 wrote to memory of 2292	2276	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d4859ffc6536a258a0bd38a7468d3d4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d4859ffc6536a258a0bd38a7468d3d4.dll,#1
  2⤵
  PID:2292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads