4acc81ad82742c7eea2d3a8a141f33e8222fa49a8a8ee95d3e1b86aa6a70a5bc | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 18:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

351991b626bea2002cc3b191ef5b19df.dll
Size

29KB
MD5

351991b626bea2002cc3b191ef5b19df
SHA1

e32f6ce5674a87460e6d5176a51c22cf07e079bd
SHA256

4acc81ad82742c7eea2d3a8a141f33e8222fa49a8a8ee95d3e1b86aa6a70a5bc
SHA512

6a62b92682c921b03983f391cc8b578d3651a9de53b3503d74c408fe74155e40eafb9d093ec975bd5b00231aaedeed3aaf6534c8750804ecead24d01c5eff783
SSDEEP

768:qrx8qUy2wYj4K5tmL+KOABBQARQkGgUg:qd7J4ZtXKOABBQARN

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 2252	2448	rundll32.exe	16
PID 2448 wrote to memory of 2252	2448	rundll32.exe	16
PID 2448 wrote to memory of 2252	2448	rundll32.exe	16
PID 2448 wrote to memory of 2252	2448	rundll32.exe	16
PID 2448 wrote to memory of 2252	2448	rundll32.exe	16
PID 2448 wrote to memory of 2252	2448	rundll32.exe	16
PID 2448 wrote to memory of 2252	2448	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\351991b626bea2002cc3b191ef5b19df.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\351991b626bea2002cc3b191ef5b19df.dll,#1
  2⤵
  PID:2252

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads