6e1a8320ee4889a7b786b1cc288007060c2ccd6bdc980ce202ebb73b28c6330a | Triage

Analysis

max time kernel
119s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 21:03

Sharing

Report Analysis Logs

General

Target

03efe7c08aec761213077dcd18253edf.dll
Size

118KB
MD5

03efe7c08aec761213077dcd18253edf
SHA1

dfdd3da3ad9aae4ed45d3a0fa9b1f2db78ea4001
SHA256

6e1a8320ee4889a7b786b1cc288007060c2ccd6bdc980ce202ebb73b28c6330a
SHA512

515373069bc9a9555e9a16468f3b5d360ec6e41855009634cd6eda04210bc68851ff720a0a0c4cc5cc1be92ea760002dd12fe54fd41b765acaa81df5d086c2eb
SSDEEP

3072:3tlkvqcaipub0lxRrKy7dddc7fA6ko8qroZRxCcCi:8yWpZl3rKyvySNR

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2124	2072	rundll32.exe	28
PID 2072 wrote to memory of 2124	2072	rundll32.exe	28
PID 2072 wrote to memory of 2124	2072	rundll32.exe	28
PID 2072 wrote to memory of 2124	2072	rundll32.exe	28
PID 2072 wrote to memory of 2124	2072	rundll32.exe	28
PID 2072 wrote to memory of 2124	2072	rundll32.exe	28
PID 2072 wrote to memory of 2124	2072	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\03efe7c08aec761213077dcd18253edf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\03efe7c08aec761213077dcd18253edf.dll,#1
  2⤵
  PID:2124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2124-0-0x0000000000100000-0x0000000000122000-memory.dmp

Filesize
136KB

Download