eabb567d402c51623e0563016748fdb1b8d701b6bcb0509eb65f8aa05d694162 | Triage

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 12:23

Sharing

Report Analysis Logs

General

Target

Lenin_Script/dll/edll.dll
Size

32KB
MD5

13321dfa8168da27a2a195bac2b66900
SHA1

aa277a8fae99b3c6a9f1b992a26d67997d51186e
SHA256

887e479d14e61e448e351c1c3d70f6acc04772ddc9fc41ab6bea8a1cae5d889f
SHA512

62b7f2d7e0edec0af6878ea944429ba37b5ea7fde6008a167f4709a94b40d640da652160bd5f91a77821046cd1d37027a1773e967efc38e281fec598d37c612f
SSDEEP

384:adLlKBrIx01Tv7A7P7W8b5mlF7yQjrZuU+cAEopXLCK1TZH:ULlErd1Tv7Iq8bEhjrZaEopvZ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 1152	2416	rundll32.exe	14
PID 2416 wrote to memory of 1152	2416	rundll32.exe	14
PID 2416 wrote to memory of 1152	2416	rundll32.exe	14
PID 2416 wrote to memory of 1152	2416	rundll32.exe	14
PID 2416 wrote to memory of 1152	2416	rundll32.exe	14
PID 2416 wrote to memory of 1152	2416	rundll32.exe	14
PID 2416 wrote to memory of 1152	2416	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Lenin_Script\dll\edll.dll,#1
1⤵
PID:1152

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Lenin_Script\dll\edll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads