513e9a0e911990eb66e6dc75089de12bb9dafeab84761d2ce04d0bca1ed3dcfb | Triage

Analysis

max time kernel
118s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 16:12

Sharing

Report Analysis Logs

General

Target

2c1988db0fbce8981fb0027f4be91be5.dll
Size

114KB
MD5

2c1988db0fbce8981fb0027f4be91be5
SHA1

3a453f958509d66830f4d3235da90f6cd6b0aeeb
SHA256

513e9a0e911990eb66e6dc75089de12bb9dafeab84761d2ce04d0bca1ed3dcfb
SHA512

8d89af51132b14439c0aaf271cf1ba7708cfcf303d373aa408a38559756f3e725a67843da70deadb3d8804bce10dcec998430f98bdf48e15465213737c4890fb
SSDEEP

3072:0VTPlRv9sB48ImmSy6sRVnfEZbDwZKlL/FYa:0NXVoNeSP2V0

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 1824	2608	rundll32.exe	29
PID 2608 wrote to memory of 1824	2608	rundll32.exe	29
PID 2608 wrote to memory of 1824	2608	rundll32.exe	29
PID 2608 wrote to memory of 1824	2608	rundll32.exe	29
PID 2608 wrote to memory of 1824	2608	rundll32.exe	29
PID 2608 wrote to memory of 1824	2608	rundll32.exe	29
PID 2608 wrote to memory of 1824	2608	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c1988db0fbce8981fb0027f4be91be5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c1988db0fbce8981fb0027f4be91be5.dll,#1
  2⤵
  PID:1824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1824-0-0x0000000010000000-0x0000000010046000-memory.dmp

Filesize
280KB

Download