13ceb7b032fbce097558d1de7bb15370b889601ffcd878a2f5605cd94224bda1 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 16:51

Sharing

Report Analysis Logs

General

Target

2e953065225d5764a5e977d9429cf13b.dll
Size

432KB
MD5

2e953065225d5764a5e977d9429cf13b
SHA1

c776056dd0d3f373fe6246697ac28ec7e7c2fa18
SHA256

13ceb7b032fbce097558d1de7bb15370b889601ffcd878a2f5605cd94224bda1
SHA512

72faaa8136ef57d91545b034df87062ea597344aaec7e4538d4c7c3a48d3256e6fbc424618a7d69a272f5f3c14f34185728bd36f726bb6349022f04e57bd906a
SSDEEP

12288:WUKHtQz/hSNSKle3WR57fL4IUlfxCftm483:W0hA4RCfQ40

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 2252	1772	rundll32.exe	28
PID 1772 wrote to memory of 2252	1772	rundll32.exe	28
PID 1772 wrote to memory of 2252	1772	rundll32.exe	28
PID 1772 wrote to memory of 2252	1772	rundll32.exe	28
PID 1772 wrote to memory of 2252	1772	rundll32.exe	28
PID 1772 wrote to memory of 2252	1772	rundll32.exe	28
PID 1772 wrote to memory of 2252	1772	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e953065225d5764a5e977d9429cf13b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2e953065225d5764a5e977d9429cf13b.dll,#1
  2⤵
  PID:2252

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads