5852f0c33e380b5d959407bd43f47f7a65ba74ad1a4bc164aacc9d6bcb89b698 | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 11:45

Sharing

Report Analysis Logs

General

Target

1bbd82f687ae5e809cb514a18b2523f1.dll
Size

123KB
MD5

1bbd82f687ae5e809cb514a18b2523f1
SHA1

39ed466902ec081d318da5975395b493722fea7c
SHA256

5852f0c33e380b5d959407bd43f47f7a65ba74ad1a4bc164aacc9d6bcb89b698
SHA512

1192465f633947ab645746254b51b39a5da2d2093ab048eb4468554846c98ec0a7dd23df80f6ab632d574c385c6b7c1e58c794d85a2dbb258c9a7725834ba46e
SSDEEP

3072:Onb/zUjxhmw8PtbIcdJ9fa3ZEmbcs1llDULII:OnbojKNsbYqU

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 2108	1128	rundll32.exe	14
PID 1128 wrote to memory of 2108	1128	rundll32.exe	14
PID 1128 wrote to memory of 2108	1128	rundll32.exe	14
PID 1128 wrote to memory of 2108	1128	rundll32.exe	14
PID 1128 wrote to memory of 2108	1128	rundll32.exe	14
PID 1128 wrote to memory of 2108	1128	rundll32.exe	14
PID 1128 wrote to memory of 2108	1128	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1bbd82f687ae5e809cb514a18b2523f1.dll,#1
1⤵
PID:2108

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1bbd82f687ae5e809cb514a18b2523f1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads