a95d54401de2271df517538dba2113ed3a94d7f92ebb8e29baa9634ee4250dbc | Triage

Analysis

max time kernel
119s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 08:13

Sharing

Report Analysis Logs

General

Target

5ed185c32b737d811e5590cafdc51eed.dll
Size

6KB
MD5

5ed185c32b737d811e5590cafdc51eed
SHA1

9713f86f77cdb6b36183e7c2031e4dfb5de7a11f
SHA256

a95d54401de2271df517538dba2113ed3a94d7f92ebb8e29baa9634ee4250dbc
SHA512

88d79cb29353d1f92a5c754ef6c3854b2b08d5f1e5f64be57efbfb0cacb36b72f242057a98a39394f985fd4c98459bd0b34aed46e6573d712c704a548e5a42df
SSDEEP

48:63mll5YVOa9VUX1iwbQWu0SB+BDq9J5SH:VDa9VUX9bQWyB+FqX5SH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 320	2668	rundll32.exe	30
PID 2668 wrote to memory of 320	2668	rundll32.exe	30
PID 2668 wrote to memory of 320	2668	rundll32.exe	30
PID 2668 wrote to memory of 320	2668	rundll32.exe	30
PID 2668 wrote to memory of 320	2668	rundll32.exe	30
PID 2668 wrote to memory of 320	2668	rundll32.exe	30
PID 2668 wrote to memory of 320	2668	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ed185c32b737d811e5590cafdc51eed.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ed185c32b737d811e5590cafdc51eed.dll,#1
  2⤵
  PID:320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads