eabb567d402c51623e0563016748fdb1b8d701b6bcb0509eb65f8aa05d694162 | Triage

Analysis

max time kernel
121s
max time network
137s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 12:23

Sharing

Report Analysis Logs

General

Target

Lenin_Script/dll/dialog.dll
Size

19KB
MD5

e6fc1297e8eb2cddab0e1be400866690
SHA1

54718e0149676ca32c3f8d40778809039096d97a
SHA256

3238d3e12ef962e588c5f51958594f6bd575a9e59da02b76cbb12cf29052c4bc
SHA512

1766780f0ab687f78f854f7f68d42a7fa75f71a7c5d47f045cf7e04047ffe25e08617ff0bac149d5e6c70faff61fc8ac4665b031e96b5b8c4647c18b5b2cfd51
SSDEEP

384:0okPNS4MMMYWJ7PTSoznJ6ZWsMy2ZMFrAhwtGf:94lMMAJ7rSoznWzeBC

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 2796	2780	rundll32.exe	27
PID 2780 wrote to memory of 2796	2780	rundll32.exe	27
PID 2780 wrote to memory of 2796	2780	rundll32.exe	27
PID 2780 wrote to memory of 2796	2780	rundll32.exe	27
PID 2780 wrote to memory of 2796	2780	rundll32.exe	27
PID 2780 wrote to memory of 2796	2780	rundll32.exe	27
PID 2780 wrote to memory of 2796	2780	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Lenin_Script\dll\dialog.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Lenin_Script\dll\dialog.dll,#1
  2⤵
  PID:2796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads