33e22c9a8fcabf0f9b5487aa03aa41480152335f5b7a11ed99f8545db99d9761 | Triage

Analysis

max time kernel
52s
max time network
29s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 19:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0241864704fe13b5ec0f3c68b74bfd9b.dll
Size

17KB
MD5

0241864704fe13b5ec0f3c68b74bfd9b
SHA1

80c3834712cdfe525ebca671f82d26e956210c28
SHA256

33e22c9a8fcabf0f9b5487aa03aa41480152335f5b7a11ed99f8545db99d9761
SHA512

bb66bf0a27e18dce68fa3051d42d5f4a0905f4d32606fb7a26bc2f1ec728bd79067d701e1173aba7e74681137c824cc1db54c7644097b81e361cebf13f227da9
SSDEEP

384:rSjGkgbQ8WOYz04UuBBQARQklUyZAAAa:r6g3Yz3BBQARQkhC

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 1892	3036	rundll32.exe	29
PID 3036 wrote to memory of 1892	3036	rundll32.exe	29
PID 3036 wrote to memory of 1892	3036	rundll32.exe	29
PID 3036 wrote to memory of 1892	3036	rundll32.exe	29
PID 3036 wrote to memory of 1892	3036	rundll32.exe	29
PID 3036 wrote to memory of 1892	3036	rundll32.exe	29
PID 3036 wrote to memory of 1892	3036	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0241864704fe13b5ec0f3c68b74bfd9b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0241864704fe13b5ec0f3c68b74bfd9b.dll,#1
  2⤵
  PID:1892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads