7d3c5d4fd375e1c25f97c9bde65393b8ab2f8b88880af0e948795392faf6613d | Triage

Analysis

max time kernel
94s
max time network
41s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 09:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6411f1d23b59f8cafc804e57f222c1a5.dll
Size

28KB
MD5

6411f1d23b59f8cafc804e57f222c1a5
SHA1

7f73ce09c38ffd5e65dbbd0f94a7fce2b44343f4
SHA256

7d3c5d4fd375e1c25f97c9bde65393b8ab2f8b88880af0e948795392faf6613d
SHA512

c1393e2fe57fc203eeea3175197b78f01bab511949cdf50157b32182bea62e34b35ddb5b40481f2eeba183eb7e44c0e385a51e860993e207ce3763afb447967a
SSDEEP

768:EMySn/ESvttGWF/KkdqrL+BBBQARQkESV8:IS/FbKfriBBQARs

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 2588	2632	rundll32.exe	28
PID 2632 wrote to memory of 2588	2632	rundll32.exe	28
PID 2632 wrote to memory of 2588	2632	rundll32.exe	28
PID 2632 wrote to memory of 2588	2632	rundll32.exe	28
PID 2632 wrote to memory of 2588	2632	rundll32.exe	28
PID 2632 wrote to memory of 2588	2632	rundll32.exe	28
PID 2632 wrote to memory of 2588	2632	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6411f1d23b59f8cafc804e57f222c1a5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6411f1d23b59f8cafc804e57f222c1a5.dll,#1
  2⤵
  PID:2588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads