658b92378595856df02428bcdf59e82b6e3ecb5180e121ec423a96a8ffc738ef | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 06:06

Sharing

Report Analysis Logs

General

Target

10ab9322d2af4fde68b2f6e97f34d540.dll
Size

27KB
MD5

10ab9322d2af4fde68b2f6e97f34d540
SHA1

8c72619432a5022a4b6537f51f085c97002a8cf0
SHA256

658b92378595856df02428bcdf59e82b6e3ecb5180e121ec423a96a8ffc738ef
SHA512

6fb97268e1e185aff93fe03dd4b686064647d223efabca807332f3d5240c47650f0339bdf93c22e75eede958758907964f5e70d84967d8bd83e4d41336f82535
SSDEEP

768:DWuhU4GQ9C/fey7D/ezXjXDwXybhTOO/H:auhU4GdVIwqOAH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2948	2936	rundll32.exe	21
PID 2936 wrote to memory of 2948	2936	rundll32.exe	21
PID 2936 wrote to memory of 2948	2936	rundll32.exe	21
PID 2936 wrote to memory of 2948	2936	rundll32.exe	21
PID 2936 wrote to memory of 2948	2936	rundll32.exe	21
PID 2936 wrote to memory of 2948	2936	rundll32.exe	21
PID 2936 wrote to memory of 2948	2936	rundll32.exe	21

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\10ab9322d2af4fde68b2f6e97f34d540.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\10ab9322d2af4fde68b2f6e97f34d540.dll,#1
  2⤵
  PID:2948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads