9f8f85a2766cde2e114d6bc85a7cbe37ab47ec3328501df38a15a8b4c5a3bbc0 | Triage

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 15:58

Sharing

Report Analysis Logs

General

Target

2b2ddcab1aa3df804e88c62ff25fb12e.dll
Size

248KB
MD5

2b2ddcab1aa3df804e88c62ff25fb12e
SHA1

e599c00905a57e482595f2404c42bf8e06d8b802
SHA256

9f8f85a2766cde2e114d6bc85a7cbe37ab47ec3328501df38a15a8b4c5a3bbc0
SHA512

5522adcb4d15c8403973332fef7097f90fac35aee9d4f5d22ad14c49b19e87f036816145219bff06eb7f18621e45a5b56a24889352366ccf9443655cdb441da9
SSDEEP

6144:4dEjetZziZfOe+Abf/0xc8aLa3AsaJBTMK1L:TjenmfOhaUmrLa7wBbL

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 2756	2596	rundll32.exe	28
PID 2596 wrote to memory of 2756	2596	rundll32.exe	28
PID 2596 wrote to memory of 2756	2596	rundll32.exe	28
PID 2596 wrote to memory of 2756	2596	rundll32.exe	28
PID 2596 wrote to memory of 2756	2596	rundll32.exe	28
PID 2596 wrote to memory of 2756	2596	rundll32.exe	28
PID 2596 wrote to memory of 2756	2596	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b2ddcab1aa3df804e88c62ff25fb12e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b2ddcab1aa3df804e88c62ff25fb12e.dll,#1
  2⤵
  PID:2756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2756-0-0x0000000000610000-0x000000000062B000-memory.dmp

Filesize
108KB

Download
memory/2756-1-0x0000000010000000-0x0000000010064000-memory.dmp

Filesize
400KB

Download