e2df1466fd071bbada70e77fccff0777c45d2e59553bd8b13bb753e7970ae5e3 | Triage

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 22:01

Sharing

Report Analysis Logs

General

Target

0510c72433f54e7282eec0c8c66eb2ae.dll
Size

30KB
MD5

0510c72433f54e7282eec0c8c66eb2ae
SHA1

457cce38ce447dd6c9d01c64097641c97ae6d354
SHA256

e2df1466fd071bbada70e77fccff0777c45d2e59553bd8b13bb753e7970ae5e3
SHA512

731dcf5e5187ef4b9ae9035490a18926976e65939dca70ade277b1ef8f96a56cd271a0ed0e9877cad09cca5e0c3c564c4d432fc632119f4a3bba20a4285a7a73
SSDEEP

768:H5JXld4eF4fShHVq2hcLDhF3jLyY7cTGgsMP:HTX3FR1v6vhlgvsMP

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2052	2528	rundll32.exe	1
PID 2528 wrote to memory of 2052	2528	rundll32.exe	1
PID 2528 wrote to memory of 2052	2528	rundll32.exe	1
PID 2528 wrote to memory of 2052	2528	rundll32.exe	1
PID 2528 wrote to memory of 2052	2528	rundll32.exe	1
PID 2528 wrote to memory of 2052	2528	rundll32.exe	1
PID 2528 wrote to memory of 2052	2528	rundll32.exe	1

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0510c72433f54e7282eec0c8c66eb2ae.dll,#1
1⤵
PID:2052

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0510c72433f54e7282eec0c8c66eb2ae.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2052-0-0x0000000075220000-0x00000000752AD000-memory.dmp

Filesize
564KB

Download
memory/2052-1-0x0000000075220000-0x00000000752AD000-memory.dmp

Filesize
564KB

Download