0657b1e4e117112d96f462e8b0721a41188b060eccc558b76c49a7f5faaf3ef8 | Triage

Analysis

max time kernel
122s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 11:02

Sharing

Report Analysis Logs

General

Target

1943414f544568b2ff270f1c2c3fc85b.dll
Size

498KB
MD5

1943414f544568b2ff270f1c2c3fc85b
SHA1

69830dedfb029b833ef6d15d4beff618a606fd45
SHA256

0657b1e4e117112d96f462e8b0721a41188b060eccc558b76c49a7f5faaf3ef8
SHA512

748a9abff17c9ea3cc26ab496fb88ef09e0617c98945d0b105099ee388a92e19f85c31abf3db741d95bd03558c790245af01825b91ffe3733812c084f6619c90
SSDEEP

12288:OX5Sqk3urM/D9WsmfSHu7v4aRqeXHveRRz2okCtRsNX:OY/xlM3X+ol

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 2256	2464	rundll32.exe	28
PID 2464 wrote to memory of 2256	2464	rundll32.exe	28
PID 2464 wrote to memory of 2256	2464	rundll32.exe	28
PID 2464 wrote to memory of 2256	2464	rundll32.exe	28
PID 2464 wrote to memory of 2256	2464	rundll32.exe	28
PID 2464 wrote to memory of 2256	2464	rundll32.exe	28
PID 2464 wrote to memory of 2256	2464	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1943414f544568b2ff270f1c2c3fc85b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1943414f544568b2ff270f1c2c3fc85b.dll,#1
  2⤵
  PID:2256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads