70234b4e936fbcbbd31557472a37953f300ff3d4ed1ea5d8a3759aa27cec3fc6 | Triage

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 20:30

Sharing

Report Analysis Logs

General

Target

f60c17044b65289b11461ce3db442582.dll
Size

33KB
MD5

f60c17044b65289b11461ce3db442582
SHA1

844f96d1a2be48d3c2b35b5eb98b9becf367f1d0
SHA256

70234b4e936fbcbbd31557472a37953f300ff3d4ed1ea5d8a3759aa27cec3fc6
SHA512

1e9432e116b5e215506c558d03bb6d1815bf76490b28c218393997b5a36122df0710b2ad742d5d3d928f561e4248d3f7d7d3aacd87a78c35808b643ad1583e1d
SSDEEP

768:R5SiPcjVLML2JEgaed9/77TrKftta4SqO8D7R8dC5:RYBjHhaeH7TrKf5pRE8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 3052	3048	rundll32.exe	14
PID 3048 wrote to memory of 3052	3048	rundll32.exe	14
PID 3048 wrote to memory of 3052	3048	rundll32.exe	14
PID 3048 wrote to memory of 3052	3048	rundll32.exe	14
PID 3048 wrote to memory of 3052	3048	rundll32.exe	14
PID 3048 wrote to memory of 3052	3048	rundll32.exe	14
PID 3048 wrote to memory of 3052	3048	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f60c17044b65289b11461ce3db442582.dll,#1
1⤵
PID:3052

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f60c17044b65289b11461ce3db442582.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads