ce302d5352b8ec00bd472a1e989edc24512e3ce80fa705f5c948f2b1753a19cb | Triage

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 19:11

Sharing

Report Analysis Logs

General

Target

01582a2f0741196c8ad12f062573b75a.dll
Size

26KB
MD5

01582a2f0741196c8ad12f062573b75a
SHA1

4fadac91dd9689ab08539fbd9136aa14cd6def9b
SHA256

ce302d5352b8ec00bd472a1e989edc24512e3ce80fa705f5c948f2b1753a19cb
SHA512

3c62f6803f63d35496d160bf597ce957590ad9ad7c39a3c2055f12fba27b2718ed33d7e21e4e95f20240699b35736d779e3b6cfe471d9b9057200b333b9a4bdc
SSDEEP

768:+0ffiBmXyQiqvRl/svYiOvX2cqDU3e0h+oMLp:+0HLkqgY9XYUTvML

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 2188	1476	rundll32.exe	13
PID 1476 wrote to memory of 2188	1476	rundll32.exe	13
PID 1476 wrote to memory of 2188	1476	rundll32.exe	13
PID 1476 wrote to memory of 2188	1476	rundll32.exe	13
PID 1476 wrote to memory of 2188	1476	rundll32.exe	13
PID 1476 wrote to memory of 2188	1476	rundll32.exe	13
PID 1476 wrote to memory of 2188	1476	rundll32.exe	13

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\01582a2f0741196c8ad12f062573b75a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\01582a2f0741196c8ad12f062573b75a.dll,#1
  2⤵
  PID:2188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads