21c3af6a300d106b3826c4a654eb4cfd32ea5de0c72a99b63f2e57ada1137240 | Triage

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 07:40

Sharing

Report Analysis Logs

General

Target

0f85cfa3e364a9b9705c014ab00bef4e.dll
Size

840KB
MD5

0f85cfa3e364a9b9705c014ab00bef4e
SHA1

3c548a77f59cb2089b27ca1be6a43f8af481079b
SHA256

21c3af6a300d106b3826c4a654eb4cfd32ea5de0c72a99b63f2e57ada1137240
SHA512

63302e084b73dbed19d12b5f611c65fd0fd6d29f3fabaa644da90ce9e4abbf3fe3c27e0282db5215fe43248f2680751bde83b98e1135fbcec5465e333ac950c8
SSDEEP

24576:bdKYR5ISWr6VLkR65+pFEikuLCurzHDz61:JKYnICwRBFxtvDW1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 1272	2104	rundll32.exe	14
PID 2104 wrote to memory of 1272	2104	rundll32.exe	14
PID 2104 wrote to memory of 1272	2104	rundll32.exe	14
PID 2104 wrote to memory of 1272	2104	rundll32.exe	14
PID 2104 wrote to memory of 1272	2104	rundll32.exe	14
PID 2104 wrote to memory of 1272	2104	rundll32.exe	14
PID 2104 wrote to memory of 1272	2104	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f85cfa3e364a9b9705c014ab00bef4e.dll,#1
1⤵
PID:1272

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f85cfa3e364a9b9705c014ab00bef4e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads