53b4bb77726d8f6074d984dbc2a07e2b74bc12fbd2d067515d84941ae13a9cab | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28-12-2023 03:54

Sharing

Report Analysis Logs

General

Target

00029056.dll
Size

13KB
MD5

d37cd9ce6c4bc95b6d8a9716c6aa1b81
SHA1

1d644b66976f969fbda933ca6b24fa4b5a92fa51
SHA256

8580147c5d93316f319a28634871c762dc8f474101dc7e4e63f8fb0aede49817
SHA512

117397a7e6e3de6f9f07e25296b334da39c5781fc99810a54aca7b5b690472f4ceca52cf249774ea4cddada208a07f45754208c18464f4f4f0c4493d3a977839
SSDEEP

96:6WMVRoO6TF6LxOV85Pgog4aJkiyScAUOjo1mHUZ5GdfdQYhl4CaDKi:65VRoOc4Bn5aJdJj2mHW+fver

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2392 wrote to memory of 2544	2392	rundll32.exe	rundll32.exe
PID 2392 wrote to memory of 2544	2392	rundll32.exe	rundll32.exe
PID 2392 wrote to memory of 2544	2392	rundll32.exe	rundll32.exe
PID 2392 wrote to memory of 2544	2392	rundll32.exe	rundll32.exe
PID 2392 wrote to memory of 2544	2392	rundll32.exe	rundll32.exe
PID 2392 wrote to memory of 2544	2392	rundll32.exe	rundll32.exe
PID 2392 wrote to memory of 2544	2392	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00029056.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2392

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00029056.dll,#1
2⤵
PID:2544

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...