17d1c8d5c57f642fc25e43854a0bc9f083a1fd03079a71a4789a23fb6b78a25a | Triage

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 19:39

Sharing

Report Analysis Logs

General

Target

0204cd9546332d7d0163028acd3aa317.dll
Size

18KB
MD5

0204cd9546332d7d0163028acd3aa317
SHA1

cdd8412c3f2dd08ccc2997bb06cdc9adb2535002
SHA256

17d1c8d5c57f642fc25e43854a0bc9f083a1fd03079a71a4789a23fb6b78a25a
SHA512

d824f95eb35b02801ce84132d1a28a6d8f5cc0620c71c6ea1a5adef9f852a1fe8856ea6fc85ff89da9b9633973548390d30b9496ed803b4e35ca1ef14f0e3886
SSDEEP

384:lNL6uYh93Z6c+SM056FOEc/zyM93gReoV:lNL6Lh93ZYZ05iqzvgRb

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2132	2172	rundll32.exe	14
PID 2172 wrote to memory of 2132	2172	rundll32.exe	14
PID 2172 wrote to memory of 2132	2172	rundll32.exe	14
PID 2172 wrote to memory of 2132	2172	rundll32.exe	14
PID 2172 wrote to memory of 2132	2172	rundll32.exe	14
PID 2172 wrote to memory of 2132	2172	rundll32.exe	14
PID 2172 wrote to memory of 2132	2172	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0204cd9546332d7d0163028acd3aa317.dll,#1
1⤵
PID:2132

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0204cd9546332d7d0163028acd3aa317.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads