45d3648f6265ac6bfd952de2c54694f9fa7501b8f62fece5bb77e89ffdc6a05d | Triage

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 10:00

Sharing

Report Analysis Logs

General

Target

15309fe5e512a5903183d7c243734e06.dll
Size

26KB
MD5

15309fe5e512a5903183d7c243734e06
SHA1

6fc190fee4663fe881ca93d464d481ba0f365a37
SHA256

45d3648f6265ac6bfd952de2c54694f9fa7501b8f62fece5bb77e89ffdc6a05d
SHA512

d2e8da72f2952ce2f9fe6be2c4c5f2518b2ff7e214d27bbb6ea37b9e2f9ea5b91676c44584b0969dc2a34eaee3a2985f98355d5e9e2c60c98d75ed7bf9e57164
SSDEEP

192:T7BZF+MPncVJREkb5xI9zHJHTrvI90i5WaC:TN+Gn85b5xIPrvI9SaC

Score

1^/10

Malware Config

Signatures

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
472	Process not Found

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2052	2044	rundll32.exe	28
PID 2044 wrote to memory of 2052	2044	rundll32.exe	28
PID 2044 wrote to memory of 2052	2044	rundll32.exe	28
PID 2044 wrote to memory of 2052	2044	rundll32.exe	28
PID 2044 wrote to memory of 2052	2044	rundll32.exe	28
PID 2044 wrote to memory of 2052	2044	rundll32.exe	28
PID 2044 wrote to memory of 2052	2044	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\15309fe5e512a5903183d7c243734e06.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\15309fe5e512a5903183d7c243734e06.dll,#1
  2⤵
  PID:2052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads