900be31f4d179735d04800d1ebd4506e6f3b2bfec7e6a592447c495f6d19193e | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 02:46

Sharing

Report Analysis Logs

General

Target

4dad7b8b35b9337ae7e2dba2a0a294a0.dll
Size

6KB
MD5

4dad7b8b35b9337ae7e2dba2a0a294a0
SHA1

cd69cd47414aa3ae0b5f8102a89b27b467987d0d
SHA256

900be31f4d179735d04800d1ebd4506e6f3b2bfec7e6a592447c495f6d19193e
SHA512

7f7ce4744fee257d91909aef416b90cbb703460b6ae9e484b60f92fb141061f295101684b243abcf8f305cea9f4ca947939897247881ff5876ee0f980857d128
SSDEEP

48:6WQV5YVOqtV0H1pw9ygYVUG0XB+BDq9J5SC:8qtV0HAr4mB+FqX5SC

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 2528	1836	rundll32.exe	28
PID 1836 wrote to memory of 2528	1836	rundll32.exe	28
PID 1836 wrote to memory of 2528	1836	rundll32.exe	28
PID 1836 wrote to memory of 2528	1836	rundll32.exe	28
PID 1836 wrote to memory of 2528	1836	rundll32.exe	28
PID 1836 wrote to memory of 2528	1836	rundll32.exe	28
PID 1836 wrote to memory of 2528	1836	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4dad7b8b35b9337ae7e2dba2a0a294a0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4dad7b8b35b9337ae7e2dba2a0a294a0.dll,#1
  2⤵
  PID:2528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads