1483adbc51ba6c07611f6af27553c16a1c535099a8e1d220805fb5792251784b | Triage

Analysis

max time kernel
120s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1d6912744a099f965d98c79714a28134.dll
Size

2.0MB
MD5

1d6912744a099f965d98c79714a28134
SHA1

fbb339af1ccc0de8902430c68bb99d0748011dfc
SHA256

1483adbc51ba6c07611f6af27553c16a1c535099a8e1d220805fb5792251784b
SHA512

34c77bcb2a760ea29ff068e7d53738f46d9e0286fcdec8fe074afaaf8618cd2201e86c8770356b8491ba594b8e35e04d5ed561fd621906ab91d4c7e75f9271d4
SSDEEP

49152:MFnPbv5rMP7bDgaKSF/XBtF8WF0WAQzJmu0B:HP7PgaKK/xk

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2748	2116	rundll32.exe	28
PID 2116 wrote to memory of 2748	2116	rundll32.exe	28
PID 2116 wrote to memory of 2748	2116	rundll32.exe	28
PID 2116 wrote to memory of 2748	2116	rundll32.exe	28
PID 2116 wrote to memory of 2748	2116	rundll32.exe	28
PID 2116 wrote to memory of 2748	2116	rundll32.exe	28
PID 2116 wrote to memory of 2748	2116	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d6912744a099f965d98c79714a28134.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d6912744a099f965d98c79714a28134.dll,#1
  2⤵
  PID:2748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads