98b89d69f042aeae86001e719364154cd0de6b13d2936a4255237df61f4a44e4 | Triage

Analysis

max time kernel
118s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7604f2b6a936db54692a70fe863504ad.dll
Size

32KB
MD5

7604f2b6a936db54692a70fe863504ad
SHA1

0b330d6f3477977a79739eb168e56a0d5eeb2c64
SHA256

98b89d69f042aeae86001e719364154cd0de6b13d2936a4255237df61f4a44e4
SHA512

e8397222b37a5a7822523b543ad6eb82b7dbe23381c6465f841899c8cb03f0b41d1d510ec0239c1a239b2a9427e885db0679ca8ee5ffb81d3a7eaf0106cde33c
SSDEEP

768:JNJ6kT9Y4BLyCayM+OHan6pHWdR48iDnBSBA6h4FJ/eJxA:JNJ6YyCmdT2H0nBJ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1096	2032	rundll32.exe	28
PID 2032 wrote to memory of 1096	2032	rundll32.exe	28
PID 2032 wrote to memory of 1096	2032	rundll32.exe	28
PID 2032 wrote to memory of 1096	2032	rundll32.exe	28
PID 2032 wrote to memory of 1096	2032	rundll32.exe	28
PID 2032 wrote to memory of 1096	2032	rundll32.exe	28
PID 2032 wrote to memory of 1096	2032	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7604f2b6a936db54692a70fe863504ad.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7604f2b6a936db54692a70fe863504ad.dll,#1
  2⤵
  PID:1096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads