3f5c98b76bd3df9540a03413c881e7b4f1eebf00f251d86827374690810d4c0f | Triage

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 02:11

Sharing

Report Analysis Logs

General

Target

4bc6f636be9020882d02ed7db6133385.dll
Size

14KB
MD5

4bc6f636be9020882d02ed7db6133385
SHA1

0e40eeac55af19ccabd73e4c7cede46445a28297
SHA256

3f5c98b76bd3df9540a03413c881e7b4f1eebf00f251d86827374690810d4c0f
SHA512

7f291f129924ec1f6abc37dfaed119c7853c48fe68e594711f048b18793b99fd81e14c4006c2a3982328d8d52eb54d2bc983073bf5231ca55fb9083285202963
SSDEEP

384:wF7TenpkkZsdbT3aPL+lUHz/fAZha/X2:kTWpvqdbb4eUT/f8e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 2292	812	rundll32.exe	28
PID 812 wrote to memory of 2292	812	rundll32.exe	28
PID 812 wrote to memory of 2292	812	rundll32.exe	28
PID 812 wrote to memory of 2292	812	rundll32.exe	28
PID 812 wrote to memory of 2292	812	rundll32.exe	28
PID 812 wrote to memory of 2292	812	rundll32.exe	28
PID 812 wrote to memory of 2292	812	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bc6f636be9020882d02ed7db6133385.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bc6f636be9020882d02ed7db6133385.dll,#1
  2⤵
  PID:2292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads