7eaa1e6932b429e5aa59ca9f786ebaa95a95de162239377c478cd06be71c9972 | Triage

Analysis

max time kernel
118s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 11:17

Sharing

Report Analysis Logs

General

Target

WINMM.dll
Size

160KB
MD5

ee6673ecef7e176e88f3d2555b2c791b
SHA1

dc82d6dc138290986a71e9894481fdac56eb4113
SHA256

d5b2bcf63c571eb4cd54552c96826e4a52c66bbf92c57338c1f3cff435334dab
SHA512

4952cbfc850cc77235ffff6ab910c9c6896149bbc8024491587e9636aefc8ac591ff8815bba0a26227909bc63aa086c24ca8093543aba33a6ee0095b741145db
SSDEEP

3072:3oaogkkoxjjYB2zaEipk9SWgkvbZK3KRc9q0rf/wLsBREj:qJxvYB1ELsaE3KRc9NuT

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 2588	2596	rundll32.exe	29
PID 2596 wrote to memory of 2588	2596	rundll32.exe	29
PID 2596 wrote to memory of 2588	2596	rundll32.exe	29
PID 2596 wrote to memory of 2588	2596	rundll32.exe	29
PID 2596 wrote to memory of 2588	2596	rundll32.exe	29
PID 2596 wrote to memory of 2588	2596	rundll32.exe	29
PID 2596 wrote to memory of 2588	2596	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WINMM.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\WINMM.dll,#1
  2⤵
  PID:2588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2588-0-0x0000000000160000-0x000000000018B000-memory.dmp

Filesize
172KB

Download
memory/2588-1-0x0000000000160000-0x000000000018B000-memory.dmp

Filesize
172KB

Download
memory/2588-2-0x0000000000160000-0x0000000000166000-memory.dmp

Filesize
24KB

Download