9b9f66acddaa97bf8bc32967ec864e89968754b8b86b6ccaa5a70a6a40ed8790 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 19:28

Sharing

Report Analysis Logs

General

Target

01b59560cf8f0a41e2c511625c7f5b70.dll
Size

36KB
MD5

01b59560cf8f0a41e2c511625c7f5b70
SHA1

3610489ac06c870573b784c823ebc63addb48dff
SHA256

9b9f66acddaa97bf8bc32967ec864e89968754b8b86b6ccaa5a70a6a40ed8790
SHA512

b6b967530b1f60f5142efc5a5b99f7a2d13cbfefe71bfb8cb70818f5a0b92bb21dd4207130185c12115f0dabadc6f2d235f1199c66c4076ecc1d16e884b1f000
SSDEEP

768:eRoftihkMWdd+rEUm5c41DBBQARQkRXFwf9+o:QsqkDn+rEUWTBBQARBM9+o

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2496	2488	rundll32.exe	28
PID 2488 wrote to memory of 2496	2488	rundll32.exe	28
PID 2488 wrote to memory of 2496	2488	rundll32.exe	28
PID 2488 wrote to memory of 2496	2488	rundll32.exe	28
PID 2488 wrote to memory of 2496	2488	rundll32.exe	28
PID 2488 wrote to memory of 2496	2488	rundll32.exe	28
PID 2488 wrote to memory of 2496	2488	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01b59560cf8f0a41e2c511625c7f5b70.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\01b59560cf8f0a41e2c511625c7f5b70.dll,#1
  2⤵
  PID:2496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads