0c38a46d84787fb27e7d25ef9bffec162f94ccf6f57d7b0c076308cf568184de | Triage

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 01:54

Sharing

Report Analysis Logs

General

Target

4ac65e417847ff09f1bc7e2cf25f26c9.dll
Size

240KB
MD5

4ac65e417847ff09f1bc7e2cf25f26c9
SHA1

2d42fe1cec3159757e0df0d6afb4cb9e3d676360
SHA256

0c38a46d84787fb27e7d25ef9bffec162f94ccf6f57d7b0c076308cf568184de
SHA512

367a1b362c5d5decae5959990c04102f01ffedcd2413862911a3847962d307756b98e3249fd6b4cc35c9d0bf1c5a11a5555d11b69d0c379e4883cbc9f4845061
SSDEEP

768:sLmdTpfMhbUWnEbsnNoI+xRWsEBBQARQkvpqcvU:smNpfMhJXaZRWsEBBQARNc

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 2528	1836	rundll32.exe	28
PID 1836 wrote to memory of 2528	1836	rundll32.exe	28
PID 1836 wrote to memory of 2528	1836	rundll32.exe	28
PID 1836 wrote to memory of 2528	1836	rundll32.exe	28
PID 1836 wrote to memory of 2528	1836	rundll32.exe	28
PID 1836 wrote to memory of 2528	1836	rundll32.exe	28
PID 1836 wrote to memory of 2528	1836	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4ac65e417847ff09f1bc7e2cf25f26c9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4ac65e417847ff09f1bc7e2cf25f26c9.dll,#1
  2⤵
  PID:2528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads