9f95bbc2460cf3466f82fe362e9df962bdf7e50ac7f19f03e32c01e832531b32 | Triage

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 15:40

Sharing

Report Analysis Logs

General

Target

2a026cebadeed3b1a008e59cb1dc707d.dll
Size

156KB
MD5

2a026cebadeed3b1a008e59cb1dc707d
SHA1

9449d43070f754374443d7156a66af7446f438d7
SHA256

9f95bbc2460cf3466f82fe362e9df962bdf7e50ac7f19f03e32c01e832531b32
SHA512

ad4a5bc3fa273808f30860ec9cb2df3048ba82e5ce880396bf9fdc04adfdadf395a6502374efaea50839af8bb9958262990070e99752413b9009204a55ff3086
SSDEEP

3072:2/F1y/bUD/tBLYtFocdqXIcv+QxLaYHv7roXKfLo:2ib4QtFoycv1xmYH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 1308	1360	rundll32.exe	28
PID 1360 wrote to memory of 1308	1360	rundll32.exe	28
PID 1360 wrote to memory of 1308	1360	rundll32.exe	28
PID 1360 wrote to memory of 1308	1360	rundll32.exe	28
PID 1360 wrote to memory of 1308	1360	rundll32.exe	28
PID 1360 wrote to memory of 1308	1360	rundll32.exe	28
PID 1360 wrote to memory of 1308	1360	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a026cebadeed3b1a008e59cb1dc707d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a026cebadeed3b1a008e59cb1dc707d.dll,#1
  2⤵
  PID:1308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1308-0-0x0000000010000000-0x000000001006B000-memory.dmp

Filesize
428KB

Download