1756fe5aef8c81e887cce6023c5e328451be1498b962c8ae2d9f15a187476320 | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 09:26

Sharing

Report Analysis Logs

General

Target

63a386707c8cf35c6c8d229233d15297.dll
Size

33KB
MD5

63a386707c8cf35c6c8d229233d15297
SHA1

e0a58021a33ebc24559c70bc4f7438997e1de715
SHA256

1756fe5aef8c81e887cce6023c5e328451be1498b962c8ae2d9f15a187476320
SHA512

4a7459dde74f13395a95235478e952ceb286535c417ebf157b6d788cb77e22db602ee107e03c05ffddbedb09c6b364509452311ffba7992cd7e03197853d505f
SSDEEP

768:/5SiPcjVLML2JEgaed9/77TrKftta4SqO8m7R8rdXM:/YBjHhaeH7TrKf5SRK+

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2124	2112	rundll32.exe	28
PID 2112 wrote to memory of 2124	2112	rundll32.exe	28
PID 2112 wrote to memory of 2124	2112	rundll32.exe	28
PID 2112 wrote to memory of 2124	2112	rundll32.exe	28
PID 2112 wrote to memory of 2124	2112	rundll32.exe	28
PID 2112 wrote to memory of 2124	2112	rundll32.exe	28
PID 2112 wrote to memory of 2124	2112	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\63a386707c8cf35c6c8d229233d15297.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\63a386707c8cf35c6c8d229233d15297.dll,#1
  2⤵
  PID:2124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads