4b986225a410654ef5117466dd4519983e98c6f0b1d1b5f9e4c11d48166e55af | Triage

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 13:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

22c4659a6b9a521d276b1ed0caf73f52.dll
Size

23KB
MD5

22c4659a6b9a521d276b1ed0caf73f52
SHA1

3abf0ccad2a8779f671776cebe4ace5feca4e5f7
SHA256

4b986225a410654ef5117466dd4519983e98c6f0b1d1b5f9e4c11d48166e55af
SHA512

010c9bbeebc14c4ec27e1ee8658fc038faed5ace6c0546400f9bc4f89ac8508d42b5e8b9445fe94044066bf27aace75cbd1bde9422da4c93cabdca9e9b154284
SSDEEP

384:o16UV/ncBXR0NUJei6ZkIgWgtW+DHV8pQYJLWLdbvCi:DmUJoKrjA1Libai

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2208	2164	rundll32.exe	28
PID 2164 wrote to memory of 2208	2164	rundll32.exe	28
PID 2164 wrote to memory of 2208	2164	rundll32.exe	28
PID 2164 wrote to memory of 2208	2164	rundll32.exe	28
PID 2164 wrote to memory of 2208	2164	rundll32.exe	28
PID 2164 wrote to memory of 2208	2164	rundll32.exe	28
PID 2164 wrote to memory of 2208	2164	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\22c4659a6b9a521d276b1ed0caf73f52.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\22c4659a6b9a521d276b1ed0caf73f52.dll,#1
  2⤵
  PID:2208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads