53b4bb77726d8f6074d984dbc2a07e2b74bc12fbd2d067515d84941ae13a9cab | Triage

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28-12-2023 03:54

Sharing

Report Analysis Logs

General

Target

00031192.dll
Size

32KB
MD5

3e5bd2c1cff236c3a233de5fe74ae361
SHA1

3acb9e128d8e6ed13c198ba11de51499a63766f6
SHA256

16f464c1118776e105a8316f28595f51d8964219eaa6d106d0cf948a0e7362b6
SHA512

739d4ba9a805d0072bf089e45a9261a1447bfbfd1e6b0f6994fa00eceab5a746d9a1d2576095b8aa030d9918a145aff216a36890a66bb54a78b5a9846425e9d7
SSDEEP

192:ihlNnoq50rrQwfp6pWCxl6XHpjpEazEaCcxI+OttAwu5I3YGUKDiancQi84YG2+f:ihPoqUrXApWCxl2/CqOE

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2108 wrote to memory of 2496	2108	rundll32.exe	rundll32.exe
PID 2108 wrote to memory of 2496	2108	rundll32.exe	rundll32.exe
PID 2108 wrote to memory of 2496	2108	rundll32.exe	rundll32.exe
PID 2108 wrote to memory of 2496	2108	rundll32.exe	rundll32.exe
PID 2108 wrote to memory of 2496	2108	rundll32.exe	rundll32.exe
PID 2108 wrote to memory of 2496	2108	rundll32.exe	rundll32.exe
PID 2108 wrote to memory of 2496	2108	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00031192.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2108

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00031192.dll,#1
2⤵
PID:2496

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...