be23aa4d943675996e284707eab99865be7ec7b59aa911fccc2a875df27b73bc | Triage

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 00:00

Sharing

Report Analysis Logs

General

Target

20e05cf40e13cd9d61e7bf94960f8df9.dll
Size

18KB
MD5

20e05cf40e13cd9d61e7bf94960f8df9
SHA1

ac72508b708c704f16670de8fef171ff428beb44
SHA256

be23aa4d943675996e284707eab99865be7ec7b59aa911fccc2a875df27b73bc
SHA512

7f2d0676c9250bc119f45005590559591597b53a77acd319501948bbc0b7490245cfcdadea1f0e4de1e94c456a271dd66e2f6827c3d9bb45b3a4b1266846c434
SSDEEP

384:nRdCyfMqlW2mQmjNyTo63Eo7vuor26g5AzXglf:/CyUqlvmQAIb37XxgmQl

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2384	1848	rundll32.exe	13
PID 1848 wrote to memory of 2384	1848	rundll32.exe	13
PID 1848 wrote to memory of 2384	1848	rundll32.exe	13
PID 1848 wrote to memory of 2384	1848	rundll32.exe	13
PID 1848 wrote to memory of 2384	1848	rundll32.exe	13
PID 1848 wrote to memory of 2384	1848	rundll32.exe	13
PID 1848 wrote to memory of 2384	1848	rundll32.exe	13

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\20e05cf40e13cd9d61e7bf94960f8df9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\20e05cf40e13cd9d61e7bf94960f8df9.dll,#1
  2⤵
  PID:2384

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads