2f14dffc4c710dd07ac001be0455bbca5beca111964dfbe83e70c934d4e0b22d | Triage

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 22:16

Sharing

Report Analysis Logs

General

Target

0562f33c6b5ceb6bf26b3972115ae993.dll
Size

7KB
MD5

0562f33c6b5ceb6bf26b3972115ae993
SHA1

1b6481c8b6df4de724947c3046d6c890941c4304
SHA256

2f14dffc4c710dd07ac001be0455bbca5beca111964dfbe83e70c934d4e0b22d
SHA512

0da3366893c205fcb58e129ab6d21186d9a7f17d0a6a91590787fd88e8c6e3811b8cdf2cb70e4ec38ee65b84dd891efa72cd687de7f2b2f6d014525da7181d20
SSDEEP

192:R5rgS1WlrRCmORiKCKhhEq79Kxlgg06DjpJ7YvkgUw9F:FwrRJ+hEqKgKP/TG

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 2600	1380	rundll32.exe	28
PID 1380 wrote to memory of 2600	1380	rundll32.exe	28
PID 1380 wrote to memory of 2600	1380	rundll32.exe	28
PID 1380 wrote to memory of 2600	1380	rundll32.exe	28
PID 1380 wrote to memory of 2600	1380	rundll32.exe	28
PID 1380 wrote to memory of 2600	1380	rundll32.exe	28
PID 1380 wrote to memory of 2600	1380	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0562f33c6b5ceb6bf26b3972115ae993.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0562f33c6b5ceb6bf26b3972115ae993.dll,#1
  2⤵
  PID:2600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2600-0-0x0000000025000000-0x0000000025014000-memory.dmp

Filesize
80KB

Download