e1f51909011a168e19a5aad55fe426a845992a08fb3616d6384b04b0c98287c4 | Triage

Analysis

max time kernel
122s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 05:54

Sharing

Report Analysis Logs

General

Target

582accc545b33ac7243436c0e89faacd.dll
Size

3KB
MD5

582accc545b33ac7243436c0e89faacd
SHA1

e1434c10f59b5adac20c0a9b9c549c02cff2ccf3
SHA256

e1f51909011a168e19a5aad55fe426a845992a08fb3616d6384b04b0c98287c4
SHA512

4a58e79616f2e4c006df555541b4770c9031937f74f12e30c59499651015b1283cd51a51950c889dc4bcd9c455e11e9be7afa90466c5052886567350521a8c9b

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 1728	1740	rundll32.exe	28
PID 1740 wrote to memory of 1728	1740	rundll32.exe	28
PID 1740 wrote to memory of 1728	1740	rundll32.exe	28
PID 1740 wrote to memory of 1728	1740	rundll32.exe	28
PID 1740 wrote to memory of 1728	1740	rundll32.exe	28
PID 1740 wrote to memory of 1728	1740	rundll32.exe	28
PID 1740 wrote to memory of 1728	1740	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\582accc545b33ac7243436c0e89faacd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\582accc545b33ac7243436c0e89faacd.dll,#1
  2⤵
  PID:1728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads