a862a910e7db2cc770af1e0280cabb6ce5f70df93f55ea9c774b6de9e48259d6 | Triage

Analysis

max time kernel
240s
max time network
290s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 23:48

Sharing

Report Analysis Logs

General

Target

077f61ac0d6a193429c6a3bff9b07472.dll
Size

14KB
MD5

077f61ac0d6a193429c6a3bff9b07472
SHA1

39dc7e49b6da9f38e77e4fb3d3b4c783cb98b227
SHA256

a862a910e7db2cc770af1e0280cabb6ce5f70df93f55ea9c774b6de9e48259d6
SHA512

c05ebd61e0ded7d42d21bf2a1a43a9e78ecc4665eba2a050172fd573fe0e22a107f33329b0087626114a98292ae796ff0163965c2fcf7ab36c2680fb7aeaabe8
SSDEEP

384:KlpnmJJk7dYeiiBfI8Ux+sZFnBrjdS3KkHl1:K3mriTvUds3KkHX

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2904	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2904	1688	rundll32.exe	26
PID 1688 wrote to memory of 2904	1688	rundll32.exe	26
PID 1688 wrote to memory of 2904	1688	rundll32.exe	26
PID 1688 wrote to memory of 2904	1688	rundll32.exe	26
PID 1688 wrote to memory of 2904	1688	rundll32.exe	26
PID 1688 wrote to memory of 2904	1688	rundll32.exe	26
PID 1688 wrote to memory of 2904	1688	rundll32.exe	26
PID 2904 wrote to memory of 1128	2904	rundll32.exe	12
PID 2904 wrote to memory of 1180	2904	rundll32.exe	13
PID 2904 wrote to memory of 1212	2904	rundll32.exe	15
PID 2904 wrote to memory of 1688	2904	rundll32.exe	25

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1128

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1180

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1212
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\077f61ac0d6a193429c6a3bff9b07472.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\077f61ac0d6a193429c6a3bff9b07472.dll,#1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1128-1-0x0000000001BC0000-0x0000000001BC1000-memory.dmp

Filesize
4KB

Download
memory/2904-0-0x0000000000800000-0x000000000080F000-memory.dmp

Filesize
60KB

Download
memory/2904-2-0x0000000000800000-0x000000000080F000-memory.dmp

Filesize
60KB

Download