78a6515fbe30d8d7e0d44948bfd9a44e7f272762a86f6bef1bb433e695a02741 | Triage

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 21:23

Sharing

Report Analysis Logs

General

Target

1cda0006ca3b11f11d07e9e7a6e85c0e.dll
Size

58KB
MD5

1cda0006ca3b11f11d07e9e7a6e85c0e
SHA1

5b4c82a7bc50c627d1042f5fd0927a367625dca7
SHA256

78a6515fbe30d8d7e0d44948bfd9a44e7f272762a86f6bef1bb433e695a02741
SHA512

970421a415daf45f461306bef5433d562b96c81958db4ff478406caece5b882e4593dc07a973adb6a521eb37205a4789d685ffc64747862383a252867f80c06e
SSDEEP

1536:SQgosHrp6cO16XbyK7SoSND2bOUZmKVbw/ER:ngrH4qXteF2bfxbAER

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2004	1992	rundll32.exe	20
PID 1992 wrote to memory of 2004	1992	rundll32.exe	20
PID 1992 wrote to memory of 2004	1992	rundll32.exe	20
PID 1992 wrote to memory of 2004	1992	rundll32.exe	20
PID 1992 wrote to memory of 2004	1992	rundll32.exe	20
PID 1992 wrote to memory of 2004	1992	rundll32.exe	20
PID 1992 wrote to memory of 2004	1992	rundll32.exe	20

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1cda0006ca3b11f11d07e9e7a6e85c0e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1cda0006ca3b11f11d07e9e7a6e85c0e.dll,#1
  2⤵
  PID:2004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads