96a5ff8a6168a597013f69e60535219f2d4f43984356e00d5fed173f6bec8391 | Triage

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 18:28

Sharing

Report Analysis Logs

General

Target

348335a2825e09e972adaa959683b366.dll
Size

96KB
MD5

348335a2825e09e972adaa959683b366
SHA1

f4b22035f40ae0ec1fdba74cab63285062ff1557
SHA256

96a5ff8a6168a597013f69e60535219f2d4f43984356e00d5fed173f6bec8391
SHA512

de4a7637f9f25109658a99385f8aaa9c258938c7693f44c2be71929d65c1d2880a8013ec22ca0c877d82e20c90661e88a29118c8ba6ef88a537a15bf6342c829
SSDEEP

3072:sxqwssvJvZNRJCYnYvLuIU2qu0747Rhu5Wtk:HwsshvZNRgYny1U747R0b

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1864	1972	rundll32.exe	28
PID 1972 wrote to memory of 1864	1972	rundll32.exe	28
PID 1972 wrote to memory of 1864	1972	rundll32.exe	28
PID 1972 wrote to memory of 1864	1972	rundll32.exe	28
PID 1972 wrote to memory of 1864	1972	rundll32.exe	28
PID 1972 wrote to memory of 1864	1972	rundll32.exe	28
PID 1972 wrote to memory of 1864	1972	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\348335a2825e09e972adaa959683b366.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\348335a2825e09e972adaa959683b366.dll,#1
  2⤵
  PID:1864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1864-0-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/1864-1-0x0000000000180000-0x0000000000192000-memory.dmp

Filesize
72KB

Download