7acfb032d581cf88de44cfbb67044cd4d0bd093f87b00813e862a7a7226a2ce3 | Triage

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 07:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

11fde2ab8b40b7a04d3c7a564c201b7e.dll
Size

19KB
MD5

11fde2ab8b40b7a04d3c7a564c201b7e
SHA1

4253c732e46443b74c41c86779bdcb3c2a13d32d
SHA256

7acfb032d581cf88de44cfbb67044cd4d0bd093f87b00813e862a7a7226a2ce3
SHA512

79841cd1bb4dce7e39dbb1b6c64e1c870a18a5987ad8902249c371cbb63fac16ad3f03f56b37f5190579f7a4f58fe76e55bca9a2ef50beccb509eb7605e9ce87
SSDEEP

384:i4Fvkj0FjtY8DdfVdBsvw88tFG8YNeNwJx8zO9a5:ikvdvxmZUGyK6as

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 936	1540	rundll32.exe	28
PID 1540 wrote to memory of 936	1540	rundll32.exe	28
PID 1540 wrote to memory of 936	1540	rundll32.exe	28
PID 1540 wrote to memory of 936	1540	rundll32.exe	28
PID 1540 wrote to memory of 936	1540	rundll32.exe	28
PID 1540 wrote to memory of 936	1540	rundll32.exe	28
PID 1540 wrote to memory of 936	1540	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\11fde2ab8b40b7a04d3c7a564c201b7e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\11fde2ab8b40b7a04d3c7a564c201b7e.dll,#1
  2⤵
  PID:936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads