6413c4038459e4774730ed5b21b8514de2edb0c9333e78ddad2c6488257a21ae | Triage

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 16:22

Sharing

Report Analysis Logs

General

Target

2cc4a11bbdd927a9527770606bec7382.dll
Size

40KB
MD5

2cc4a11bbdd927a9527770606bec7382
SHA1

0b5b50ae0ff1320aec227c29a5de8ea9429561c1
SHA256

6413c4038459e4774730ed5b21b8514de2edb0c9333e78ddad2c6488257a21ae
SHA512

c438140017587114b017a94a2fcab13613214d68b1fa029616e1707192eecb0fc13b4203a2ee5dc65526d51ae544dd392f000eeeee45f4c8116626df655ac4e8
SSDEEP

768:6IJaggKhUHTn0TOXzqW0UBBQARQk3hlA/MxZF:Dagg4CM2uW0UBBQARhkU

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 1380	3036	rundll32.exe	28
PID 3036 wrote to memory of 1380	3036	rundll32.exe	28
PID 3036 wrote to memory of 1380	3036	rundll32.exe	28
PID 3036 wrote to memory of 1380	3036	rundll32.exe	28
PID 3036 wrote to memory of 1380	3036	rundll32.exe	28
PID 3036 wrote to memory of 1380	3036	rundll32.exe	28
PID 3036 wrote to memory of 1380	3036	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cc4a11bbdd927a9527770606bec7382.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cc4a11bbdd927a9527770606bec7382.dll,#1
  2⤵
  PID:1380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads