36c08c7ec468edcd469ecd5829627db169da03edc8d2056282be992333e86b57 | Triage

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 16:03

Sharing

Report Analysis Logs

General

Target

2b866048e846f67fc983cb5ca4131fca.dll
Size

97KB
MD5

2b866048e846f67fc983cb5ca4131fca
SHA1

65513390ae876b8839ff176b58b4c96760d7c17c
SHA256

36c08c7ec468edcd469ecd5829627db169da03edc8d2056282be992333e86b57
SHA512

e34dffdfb54b9d46ce6c854e8d1f7318c4c08f74189c0980bc070ffeb59a4d2588c70d4ac1f6104667264ac7db4b2876c7a937c58c8e1cd4a0af154db3d5248f
SSDEEP

3072:g7SMAEsp+akL6ma0BRR7LuSFA4fhRzqEs:g7S3B7Q6mDTnTlhcEs

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2448	2036	rundll32.exe	28
PID 2036 wrote to memory of 2448	2036	rundll32.exe	28
PID 2036 wrote to memory of 2448	2036	rundll32.exe	28
PID 2036 wrote to memory of 2448	2036	rundll32.exe	28
PID 2036 wrote to memory of 2448	2036	rundll32.exe	28
PID 2036 wrote to memory of 2448	2036	rundll32.exe	28
PID 2036 wrote to memory of 2448	2036	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b866048e846f67fc983cb5ca4131fca.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b866048e846f67fc983cb5ca4131fca.dll,#1
  2⤵
  PID:2448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2448-0-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download
memory/2448-1-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download