29a9ec87cf2396aedb509c6d9069a788c69c21e673626acd5fff64d6f08281ad | Triage

Analysis

max time kernel
118s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 09:07

Sharing

Report Analysis Logs

General

Target

13e2afcd2d0f8cb8575f22b56c17310a.dll
Size

3KB
MD5

13e2afcd2d0f8cb8575f22b56c17310a
SHA1

9729b271f5b24a290787a5453e1bbc67b38cc3e1
SHA256

29a9ec87cf2396aedb509c6d9069a788c69c21e673626acd5fff64d6f08281ad
SHA512

93315c55e3ca657a0272618550c379811eee2fb98b0670c736d8a3c87bcd143a5c5628c848ea299ffe68102633f7e66e3e75ab65edd84035b7a4412ab35c7d40

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2008	2556	rundll32.exe	28
PID 2556 wrote to memory of 2008	2556	rundll32.exe	28
PID 2556 wrote to memory of 2008	2556	rundll32.exe	28
PID 2556 wrote to memory of 2008	2556	rundll32.exe	28
PID 2556 wrote to memory of 2008	2556	rundll32.exe	28
PID 2556 wrote to memory of 2008	2556	rundll32.exe	28
PID 2556 wrote to memory of 2008	2556	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\13e2afcd2d0f8cb8575f22b56c17310a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\13e2afcd2d0f8cb8575f22b56c17310a.dll,#1
  2⤵
  PID:2008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads