6e972fe07e121ff3b95dc1d408aa47c3cef2934c38386a277d76ee7baeb96b4b | Triage

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 09:19

Sharing

Report Analysis Logs

General

Target

14548d9fd5e154164fbafb0a7ebc8afc.dll
Size

56KB
MD5

14548d9fd5e154164fbafb0a7ebc8afc
SHA1

026bafcc252b3cb4f8bab15f5c1be4e2f58a1ced
SHA256

6e972fe07e121ff3b95dc1d408aa47c3cef2934c38386a277d76ee7baeb96b4b
SHA512

895f4b691f3ac28a9e591a29d4d85474215ae62eaa82fc7ff756a881c059eee9ccc042d8c014ed0f8ce808fd197f73621ee49125a28038485a164beeda87c185
SSDEEP

1536:jXqf0rC+5mjjWb8XN3aBQ+PJ+KeiCX87VwNo:jXqJ4qjX6PgPs7+N

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2172	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2172	2520	rundll32.exe	28
PID 2520 wrote to memory of 2172	2520	rundll32.exe	28
PID 2520 wrote to memory of 2172	2520	rundll32.exe	28
PID 2520 wrote to memory of 2172	2520	rundll32.exe	28
PID 2520 wrote to memory of 2172	2520	rundll32.exe	28
PID 2520 wrote to memory of 2172	2520	rundll32.exe	28
PID 2520 wrote to memory of 2172	2520	rundll32.exe	28
PID 2172 wrote to memory of 1244	2172	rundll32.exe	7

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1244
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\14548d9fd5e154164fbafb0a7ebc8afc.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\14548d9fd5e154164fbafb0a7ebc8afc.dll,#1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1244-1-0x0000000002950000-0x0000000002951000-memory.dmp

Filesize
4KB

Download
memory/2172-0-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download