7b900a4dc88b815e6f59592a49c7604faca3cf331abed7b6d89313315d816848 | Triage

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 15:27

Sharing

Report Analysis Logs

General

Target

78d90e99c4be8430f25b9ddad3f69b2e.dll
Size

609KB
MD5

78d90e99c4be8430f25b9ddad3f69b2e
SHA1

5fa1c388ba10b20f1ee52d2ab6564dabd4a87337
SHA256

7b900a4dc88b815e6f59592a49c7604faca3cf331abed7b6d89313315d816848
SHA512

c9405c1641b6a8adbefd09abdde801deb3446350e462a174daadcdc4d893c36e41c2ff2366909cc98c880445ec72b38454005e085a8648e6b5b0817b1410ffe2
SSDEEP

768:Cu1GPvjhjM0mK5FkgdRnG4QA7ayEi6PAdQqqf:7wjtBhRnG4/PJG

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 1968	2332	rundll32.exe	16
PID 2332 wrote to memory of 1968	2332	rundll32.exe	16
PID 2332 wrote to memory of 1968	2332	rundll32.exe	16
PID 2332 wrote to memory of 1968	2332	rundll32.exe	16
PID 2332 wrote to memory of 1968	2332	rundll32.exe	16
PID 2332 wrote to memory of 1968	2332	rundll32.exe	16
PID 2332 wrote to memory of 1968	2332	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\78d90e99c4be8430f25b9ddad3f69b2e.dll,#1
1⤵
PID:1968

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\78d90e99c4be8430f25b9ddad3f69b2e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1968-2-0x0000000000110000-0x000000000012B000-memory.dmp

Filesize
108KB

Download
memory/1968-1-0x0000000000110000-0x000000000012B000-memory.dmp

Filesize
108KB

Download
memory/1968-0-0x0000000000110000-0x000000000012B000-memory.dmp

Filesize
108KB

Download
memory/1968-3-0x0000000000120000-0x0000000000126000-memory.dmp

Filesize
24KB

Download