6251aa565189a4d19e131cdb8006247710a61ea4200b3685beb1feb6ed909d79 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 22:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fc108689ea6e9e0160b598cdfd6413aa.dll
Size

6KB
MD5

fc108689ea6e9e0160b598cdfd6413aa
SHA1

fe9e9acdda525e8fc08deff0a1cfe130d8e53e3d
SHA256

6251aa565189a4d19e131cdb8006247710a61ea4200b3685beb1feb6ed909d79
SHA512

33dab219d50426374b57cde5fd0472cbdd09977e55b586cb0b91110e378fcaaade2de7742ac26948db15058b58fe3ec53484d6b67a3f1ea391ac184e302ee441
SSDEEP

48:63mll5YVOa9VUX1iwbQWu0unB+BDq9J5SH:VDa9VUX9bQWOnB+FqX5SH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2276	3020	rundll32.exe	28
PID 3020 wrote to memory of 2276	3020	rundll32.exe	28
PID 3020 wrote to memory of 2276	3020	rundll32.exe	28
PID 3020 wrote to memory of 2276	3020	rundll32.exe	28
PID 3020 wrote to memory of 2276	3020	rundll32.exe	28
PID 3020 wrote to memory of 2276	3020	rundll32.exe	28
PID 3020 wrote to memory of 2276	3020	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc108689ea6e9e0160b598cdfd6413aa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc108689ea6e9e0160b598cdfd6413aa.dll,#1
  2⤵
  PID:2276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads