5464491219d06ebb7fb0e1e331f3944764ea6e8a7f7014b1d60cb70804341851 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 04:12

Sharing

Report Analysis Logs

General

Target

0e0cb4237695952390635d644174c888.dll
Size

97KB
MD5

0e0cb4237695952390635d644174c888
SHA1

0220257d1a76a93cb5f2ce5ffeefff9c8bfb81b8
SHA256

5464491219d06ebb7fb0e1e331f3944764ea6e8a7f7014b1d60cb70804341851
SHA512

b5b15fb0a5b41acb889559d1dd0ff17b12f6b8ba93ba1315119afc6913eedb66ff5020f46bd14edba32515e1d64a5f7fa490000632c99d520361d4bc7019490c
SSDEEP

3072:eeszgDU7kI+l0N5hlE53cTIszGwUFMxtz:YB7kIhdWyc6X

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2360	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2360	2352	rundll32.exe	28
PID 2352 wrote to memory of 2360	2352	rundll32.exe	28
PID 2352 wrote to memory of 2360	2352	rundll32.exe	28
PID 2352 wrote to memory of 2360	2352	rundll32.exe	28
PID 2352 wrote to memory of 2360	2352	rundll32.exe	28
PID 2352 wrote to memory of 2360	2352	rundll32.exe	28
PID 2352 wrote to memory of 2360	2352	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e0cb4237695952390635d644174c888.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e0cb4237695952390635d644174c888.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2360-0-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download
memory/2360-1-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download
memory/2360-2-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download