803c1ba0cbac374bcba279b4d9cbc29a57c25209772c33bc5f5b9ca97342fbf0 | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 09:50

Sharing

Report Analysis Logs

General

Target

6509a245423b1f71d3c913586a9fd082.dll
Size

40KB
MD5

6509a245423b1f71d3c913586a9fd082
SHA1

ed2fee684ea1a5489ae96d86ff74f4d2840e0514
SHA256

803c1ba0cbac374bcba279b4d9cbc29a57c25209772c33bc5f5b9ca97342fbf0
SHA512

39f4b3923684416c711502fc74dc6be838269e21631817db7be36596f185a9708a77d02f20287f122b8a50ab48fd3fbcc680ce22f93a8971ce019dc2430b48a8
SSDEEP

768:8Z2aeDFgI73nD/PvrsC6KM/e4JBBQARQkmQhHA/:8Qai4Le4JBBQARWam

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2992	2988	rundll32.exe	28
PID 2988 wrote to memory of 2992	2988	rundll32.exe	28
PID 2988 wrote to memory of 2992	2988	rundll32.exe	28
PID 2988 wrote to memory of 2992	2988	rundll32.exe	28
PID 2988 wrote to memory of 2992	2988	rundll32.exe	28
PID 2988 wrote to memory of 2992	2988	rundll32.exe	28
PID 2988 wrote to memory of 2992	2988	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6509a245423b1f71d3c913586a9fd082.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6509a245423b1f71d3c913586a9fd082.dll,#1
  2⤵
  PID:2992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads