80174a044e03f78d78e6f56d844e205ab106d81764b429ebf857c5466c6c1c8e | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 07:11

Sharing

Report Analysis Logs

General

Target

11d32ae1fa32ea759bca2a6132e32b51.dll
Size

118KB
MD5

11d32ae1fa32ea759bca2a6132e32b51
SHA1

fcfd0507aa9de94ee2374c7f5ac7f6f3f07af2f1
SHA256

80174a044e03f78d78e6f56d844e205ab106d81764b429ebf857c5466c6c1c8e
SHA512

8324fe1b1c1f645547b24841d6e39e806bbdb3f55b8a61d9a46f35ae090e82c72e9cc03c541a74a81c2e702b6dacf1c0948642430279fec9bc355b27ad6221a1
SSDEEP

3072:3Ilkvqcaipub0lxRrKy7dddc7fA6kqXVB/SZEypxCcqi:jyWpZl3rKyvySpme

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 1264	1964	rundll32.exe	28
PID 1964 wrote to memory of 1264	1964	rundll32.exe	28
PID 1964 wrote to memory of 1264	1964	rundll32.exe	28
PID 1964 wrote to memory of 1264	1964	rundll32.exe	28
PID 1964 wrote to memory of 1264	1964	rundll32.exe	28
PID 1964 wrote to memory of 1264	1964	rundll32.exe	28
PID 1964 wrote to memory of 1264	1964	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\11d32ae1fa32ea759bca2a6132e32b51.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\11d32ae1fa32ea759bca2a6132e32b51.dll,#1
  2⤵
  PID:1264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1264-0-0x0000000000180000-0x00000000001A2000-memory.dmp

Filesize
136KB

Download