79bba394b4518c82425b69cd1ef756987e5a22cc182169ccb2f3a2f3d603d6cc | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 16:06

Sharing

Report Analysis Logs

General

Target

2bc28e1e435e84e9f6ddb8d877faad75.dll
Size

234KB
MD5

2bc28e1e435e84e9f6ddb8d877faad75
SHA1

c79813b6d1149e5c75d15f6e3d57229eba655cc6
SHA256

79bba394b4518c82425b69cd1ef756987e5a22cc182169ccb2f3a2f3d603d6cc
SHA512

1b48c4ce710cbc35a9893ec06a647a4a28cf2e8b13716d5783de0bccd90bb0f0c768fb8f692d49188afd0669dae91bd470914bd3a88ebdf67f7421c89b7b1878
SSDEEP

6144:widg+ksgWfAkavzU5xPl7MJXHo83eGGIgEnYhMPJQ1:/JAWfXnPRMdI83ShMPE

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 640	2196	rundll32.exe	16
PID 2196 wrote to memory of 640	2196	rundll32.exe	16
PID 2196 wrote to memory of 640	2196	rundll32.exe	16
PID 2196 wrote to memory of 640	2196	rundll32.exe	16
PID 2196 wrote to memory of 640	2196	rundll32.exe	16
PID 2196 wrote to memory of 640	2196	rundll32.exe	16
PID 2196 wrote to memory of 640	2196	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2bc28e1e435e84e9f6ddb8d877faad75.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2bc28e1e435e84e9f6ddb8d877faad75.dll,#1
  2⤵
  PID:640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads