e0627198002adf5b212bc2b7f1064b9e6c411a2f350d1ec66c3bdaaf2b39fbfd | Triage

Analysis

max time kernel
19s
max time network
38s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 10:38

Sharing

Report Analysis Logs

General

Target

17cbd0ea28c8f2ba970e7a34d98d73b6.dll
Size

2KB
MD5

17cbd0ea28c8f2ba970e7a34d98d73b6
SHA1

c4f96605e27693754d8c294fb20ef526619b5252
SHA256

e0627198002adf5b212bc2b7f1064b9e6c411a2f350d1ec66c3bdaaf2b39fbfd
SHA512

67f02b455f69ce602381568f633962655e8d21ea69ed37162942b4c68e7bdab19b21bfef6010b381866667fcca6c5f77ab9d6d701e404c45c8036fe3bdc12db5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2740	2848	rundll32.exe	30
PID 2848 wrote to memory of 2740	2848	rundll32.exe	30
PID 2848 wrote to memory of 2740	2848	rundll32.exe	30
PID 2848 wrote to memory of 2740	2848	rundll32.exe	30
PID 2848 wrote to memory of 2740	2848	rundll32.exe	30
PID 2848 wrote to memory of 2740	2848	rundll32.exe	30
PID 2848 wrote to memory of 2740	2848	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\17cbd0ea28c8f2ba970e7a34d98d73b6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\17cbd0ea28c8f2ba970e7a34d98d73b6.dll,#1
  2⤵
  PID:2740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2740-0-0x000000006A9D0000-0x000000006AB25000-memory.dmp

Filesize
1.3MB

Download
memory/2740-1-0x000000006A9D0000-0x000000006AB25000-memory.dmp

Filesize
1.3MB

Download