ca89cdb388463c42f48a6a56e445b2628b503af2a8caa2d907e1448bb0136314 | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 13:23

Sharing

Report Analysis Logs

General

Target

7221e193a8ebf7e083126ccdfde38cad.dll
Size

51KB
MD5

7221e193a8ebf7e083126ccdfde38cad
SHA1

9dfb4c924ae5d4af5dac7922e56df1106d49911d
SHA256

ca89cdb388463c42f48a6a56e445b2628b503af2a8caa2d907e1448bb0136314
SHA512

eb58885e4890a283de15a7669b3e34525b7b6085931fba7ad194f1fe4aa7326cb22f714c4761e9c91b834e2d513d9739d2d2eb6ce8a00e18054863ae755413c0
SSDEEP

1536:qkMm6tnqcfcHGz7ZDoCaa+3en2bSrpeL13aK4:qkMm6tnqcfcHGn5oG2bSrMv4

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2416	2956	rundll32.exe	28
PID 2956 wrote to memory of 2416	2956	rundll32.exe	28
PID 2956 wrote to memory of 2416	2956	rundll32.exe	28
PID 2956 wrote to memory of 2416	2956	rundll32.exe	28
PID 2956 wrote to memory of 2416	2956	rundll32.exe	28
PID 2956 wrote to memory of 2416	2956	rundll32.exe	28
PID 2956 wrote to memory of 2416	2956	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7221e193a8ebf7e083126ccdfde38cad.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7221e193a8ebf7e083126ccdfde38cad.dll,#1
  2⤵
  PID:2416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads