2e05e23eddefd10e92d78f67791aca202873e4d77eb89aa32b4f32ce60a3da67 | Triage

Analysis

max time kernel
118s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 09:31

Sharing

Report Analysis Logs

General

Target

64006cbb9254e612f0feaa6462967493.dll
Size

40KB
MD5

64006cbb9254e612f0feaa6462967493
SHA1

14356de0859883890850f3b83a3f259065c5e5b7
SHA256

2e05e23eddefd10e92d78f67791aca202873e4d77eb89aa32b4f32ce60a3da67
SHA512

daeffb412da5ec8beb2fc05b2c93128a3b0ee2862fea8899225460074fd312ec1e6a25b660731086860b3035497c2682b0b79891b4ba704208a7973658569cf1
SSDEEP

768:Z0PriXnXXLAZ/vrsCGK//e4JBBQARQkPhHA/C:mPRcSe4JBBQARpm

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2320	2268	rundll32.exe	27
PID 2268 wrote to memory of 2320	2268	rundll32.exe	27
PID 2268 wrote to memory of 2320	2268	rundll32.exe	27
PID 2268 wrote to memory of 2320	2268	rundll32.exe	27
PID 2268 wrote to memory of 2320	2268	rundll32.exe	27
PID 2268 wrote to memory of 2320	2268	rundll32.exe	27
PID 2268 wrote to memory of 2320	2268	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\64006cbb9254e612f0feaa6462967493.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\64006cbb9254e612f0feaa6462967493.dll,#1
  2⤵
  PID:2320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads