92cd7454ff7964faec23535183d786286dec33bfe5897ed42a42beea7391837e | Triage

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 02:38

Sharing

Report Analysis Logs

General

Target

0be9a39314115a4707d1ace1f4a6c650.dll
Size

30KB
MD5

0be9a39314115a4707d1ace1f4a6c650
SHA1

59665a7a1a1d4c77a24908dab02d255ed666119d
SHA256

92cd7454ff7964faec23535183d786286dec33bfe5897ed42a42beea7391837e
SHA512

24a9d8da7a11e52f5e33b8dc655777b4d330a35ca0810565d6a669b2591fcc2214f488e718e27a460ed6760ab3837a753961d296ef490673a21c89e39d046bde
SSDEEP

768:W1Ul0JTcaSF+GjMdn01Tlfzy2Pr+mWSE:WK+waSFZen0vfG2z+mWB

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2624	2912	rundll32.exe	29
PID 2912 wrote to memory of 2624	2912	rundll32.exe	29
PID 2912 wrote to memory of 2624	2912	rundll32.exe	29
PID 2912 wrote to memory of 2624	2912	rundll32.exe	29
PID 2912 wrote to memory of 2624	2912	rundll32.exe	29
PID 2912 wrote to memory of 2624	2912	rundll32.exe	29
PID 2912 wrote to memory of 2624	2912	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0be9a39314115a4707d1ace1f4a6c650.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0be9a39314115a4707d1ace1f4a6c650.dll,#1
  2⤵
  PID:2624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads