793430e4f55eb97d39bf0a04f18dda7d08dbdf186f9bead152b1a46669648dde | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 01:49

Sharing

Report Analysis Logs

General

Target

4a8343b2e7d234d46676d2619fb2f772.dll
Size

30KB
MD5

4a8343b2e7d234d46676d2619fb2f772
SHA1

01e05934cb0b22c102b34448c9648cc6003f93f7
SHA256

793430e4f55eb97d39bf0a04f18dda7d08dbdf186f9bead152b1a46669648dde
SHA512

8ff5003bafd7bc1047abe3d0f63ad303d85ce9d1dbb2525eea37b339112d6290f0f2743bc138cc167b734e73f481c41bece248d9bc6a1d2114d328a2b60abcdd
SSDEEP

768:FBuRevqdREukbpM1N86BBQARQklX7V0q:mReNbOBBQARBCq

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2456	2148	rundll32.exe	28
PID 2148 wrote to memory of 2456	2148	rundll32.exe	28
PID 2148 wrote to memory of 2456	2148	rundll32.exe	28
PID 2148 wrote to memory of 2456	2148	rundll32.exe	28
PID 2148 wrote to memory of 2456	2148	rundll32.exe	28
PID 2148 wrote to memory of 2456	2148	rundll32.exe	28
PID 2148 wrote to memory of 2456	2148	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a8343b2e7d234d46676d2619fb2f772.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a8343b2e7d234d46676d2619fb2f772.dll,#1
  2⤵
  PID:2456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads