a0d36f0047f58a8df7f259f03fb1fb1cee6872f9050d7d06335afca53b2522c1 | Triage

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 17:13

Sharing

Report Analysis Logs

General

Target

3001be588e91bd2961c6624515be8c8b.dll
Size

102KB
MD5

3001be588e91bd2961c6624515be8c8b
SHA1

86ba7a8bd169c2f5076651fa3d58901c51b59a8b
SHA256

a0d36f0047f58a8df7f259f03fb1fb1cee6872f9050d7d06335afca53b2522c1
SHA512

b1dbd6b717b04ebde8d5286b310fc82ba14bd757552f9ca3db95a80c5ae3430bc0d9600f5601b974f133075870e4ab31a852a7e95aa83433e90c118d98bf41be
SSDEEP

1536:8+NQVimdYXz3AaEJw5w1pZcP4xgadSrRWYL4Hw:lNQL6Dngw5w1jcAxqWYL5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 2824	1276	rundll32.exe	27
PID 1276 wrote to memory of 2824	1276	rundll32.exe	27
PID 1276 wrote to memory of 2824	1276	rundll32.exe	27
PID 1276 wrote to memory of 2824	1276	rundll32.exe	27
PID 1276 wrote to memory of 2824	1276	rundll32.exe	27
PID 1276 wrote to memory of 2824	1276	rundll32.exe	27
PID 1276 wrote to memory of 2824	1276	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3001be588e91bd2961c6624515be8c8b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3001be588e91bd2961c6624515be8c8b.dll,#1
  2⤵
  PID:2824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2824-0-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download