53b4bb77726d8f6074d984dbc2a07e2b74bc12fbd2d067515d84941ae13a9cab | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28-12-2023 03:54

Sharing

Report Analysis Logs

General

Target

00000128.dll
Size

12KB
MD5

929821eae26992ab1183ce2fe7d2d2dd
SHA1

7a865758554221fe1f3d30de9ae887fd928404f9
SHA256

41515c49af8c105cab3b2b1410a0ee149fdccc55125d60e53f0705fdb76bd112
SHA512

55ee58f2390983406d8c8093dfb99e224342e9e1d16f3babef848ef6574a388fecf8cd0b2bc6ff5f172c3540a1959577ee4c97fe93735101b83b2e6ae26c7df5
SSDEEP

192:LVNj+n0tJpRIczFdXQtRhlEJcQOV7PO2LH4shuRWjxUWCW:5NhJcc3XKhyYbLH4shEWjxUWv

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2416 wrote to memory of 2940	2416	rundll32.exe	rundll32.exe
PID 2416 wrote to memory of 2940	2416	rundll32.exe	rundll32.exe
PID 2416 wrote to memory of 2940	2416	rundll32.exe	rundll32.exe
PID 2416 wrote to memory of 2940	2416	rundll32.exe	rundll32.exe
PID 2416 wrote to memory of 2940	2416	rundll32.exe	rundll32.exe
PID 2416 wrote to memory of 2940	2416	rundll32.exe	rundll32.exe
PID 2416 wrote to memory of 2940	2416	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00000128.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2416

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00000128.dll,#1
2⤵
PID:2940

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2940-0-0x0000000000140000-0x0000000000143000-memory.dmp

Filesize
12KB

Download
memory/2940-1-0x0000000000140000-0x0000000000143000-memory.dmp

Filesize
12KB

Download
memory/2940-2-0x0000000000140000-0x0000000000143000-memory.dmp

Filesize
12KB

Download
memory/2940-3-0x0000000000190000-0x0000000000192000-memory.dmp

Filesize
8KB

Download