069f636fa3c81f052ecc401898a751b40ee23f093ff6834cda2bc9aac0c00a60 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 10:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

17340455efa31ecc006a56bfe91e79f4.dll
Size

1.4MB
MD5

17340455efa31ecc006a56bfe91e79f4
SHA1

9e2fd0ad09930d6a7775597a179550492f2632ea
SHA256

069f636fa3c81f052ecc401898a751b40ee23f093ff6834cda2bc9aac0c00a60
SHA512

4ad66c243dc4e96b97b5b86e150b29ac2a68d4c819104e11983d65febe82817688987b2d82ccabe8022341308254936baac46e3fff6e561826bc21b226169b6c
SSDEEP

24576:dIyw7hqztOwDnE81g12ISV98fjAz8CCg+KjTM8:OFk3Dnf1QSV9Kj2CgnjT

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2444	1732	rundll32.exe	16
PID 1732 wrote to memory of 2444	1732	rundll32.exe	16
PID 1732 wrote to memory of 2444	1732	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\17340455efa31ecc006a56bfe91e79f4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1732 -s 80
  2⤵
  PID:2444

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads