13b1905df941b9cb19b679cd699a36464c8c419d8ad5ba4df1c7b82cad40278e | Triage

Analysis

max time kernel
1s
max time network
5s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 08:53

Sharing

Report Analysis Logs

General

Target

133e0cd763163f52398181c327308062.dll
Size

150KB
MD5

133e0cd763163f52398181c327308062
SHA1

59402c90a6b2af1080faeaa1f92558f9d87839f2
SHA256

13b1905df941b9cb19b679cd699a36464c8c419d8ad5ba4df1c7b82cad40278e
SHA512

dd8ec79cadea3dfae11d679d7855a4b61b2eb902d06e6dd3648a21d0f2fcae83b26fd0946fb623c766fa1e82f7b965ba9a4c08273e000763f1e76a545a8ab518
SSDEEP

3072:TTWDGeQbILS00wgTQhkLGhBvg7WFdyR5vt2mG6:TTqjL4ijBjmT

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2208	2212	rundll32.exe	28
PID 2212 wrote to memory of 2208	2212	rundll32.exe	28
PID 2212 wrote to memory of 2208	2212	rundll32.exe	28
PID 2212 wrote to memory of 2208	2212	rundll32.exe	28
PID 2212 wrote to memory of 2208	2212	rundll32.exe	28
PID 2212 wrote to memory of 2208	2212	rundll32.exe	28
PID 2212 wrote to memory of 2208	2212	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\133e0cd763163f52398181c327308062.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\133e0cd763163f52398181c327308062.dll,#1
  2⤵
  PID:2208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads