7419123bef0daef9ff03194428ff6a9831f0d863a209020022c8157d2b8f4eae | Triage

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 16:05

Sharing

Report Analysis Logs

General

Target

2bb103d88306a2149c6179f15f20e3aa.dll
Size

948KB
MD5

2bb103d88306a2149c6179f15f20e3aa
SHA1

2cbadacff8ccbdf3a36d8a232709476c7174811d
SHA256

7419123bef0daef9ff03194428ff6a9831f0d863a209020022c8157d2b8f4eae
SHA512

83867b6cb9cf55c16ac75083a8cf1617c802a3c8c764e6ed4cb366f108917f06d0045eb339e67063ee6601efae2be128b2a0a72597524bb6267332ef04d77241
SSDEEP

12288:51fTibHETHArqdjXXEhD1FEAic26N7aIAGG:/TizETgOd7EhD7Lib6Ne1GG

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2904	2536	rundll32.exe	16
PID 2536 wrote to memory of 2904	2536	rundll32.exe	16
PID 2536 wrote to memory of 2904	2536	rundll32.exe	16
PID 2536 wrote to memory of 2904	2536	rundll32.exe	16
PID 2536 wrote to memory of 2904	2536	rundll32.exe	16
PID 2536 wrote to memory of 2904	2536	rundll32.exe	16
PID 2536 wrote to memory of 2904	2536	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2bb103d88306a2149c6179f15f20e3aa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2bb103d88306a2149c6179f15f20e3aa.dll,#1
  2⤵
  PID:2904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads