cfd18a8f5dc6e779834e9e68389248164c775d93fd71389b5612beb1a145a95d | Triage

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 09:17

Sharing

Report Analysis Logs

General

Target

144910e6cbcdc73db47408a08605a4f2.dll
Size

6KB
MD5

144910e6cbcdc73db47408a08605a4f2
SHA1

e17b6fa6a045941b74a8c3043165b82c6bf3b040
SHA256

cfd18a8f5dc6e779834e9e68389248164c775d93fd71389b5612beb1a145a95d
SHA512

4f5bacb22b7256f375c720b88595dcf7c23d48beb333051c1509412244aa5191cd8daf62fd5c45213bf8cf1f5d29b700931b9bf83fb4e15548799e25f1d13abc
SSDEEP

48:63mll5YVOa9VUX1iwbQWu0cB+BDq9J5SH:VDa9VUX9bQW8B+FqX5SH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2152	2416	rundll32.exe	28
PID 2416 wrote to memory of 2152	2416	rundll32.exe	28
PID 2416 wrote to memory of 2152	2416	rundll32.exe	28
PID 2416 wrote to memory of 2152	2416	rundll32.exe	28
PID 2416 wrote to memory of 2152	2416	rundll32.exe	28
PID 2416 wrote to memory of 2152	2416	rundll32.exe	28
PID 2416 wrote to memory of 2152	2416	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\144910e6cbcdc73db47408a08605a4f2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\144910e6cbcdc73db47408a08605a4f2.dll,#1
  2⤵
  PID:2152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads