64062a1205d70c2a1ed2a6e9350c8de10dc9d05b40ed34d98f838efcae8efe17 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 01:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

232c31d5696e1f99111782ec7f4641ef.dll
Size

32KB
MD5

232c31d5696e1f99111782ec7f4641ef
SHA1

384a7d5f64dce486c065b968ad20551e01614559
SHA256

64062a1205d70c2a1ed2a6e9350c8de10dc9d05b40ed34d98f838efcae8efe17
SHA512

34eb46f3fab9ad08a40556335076de9a84067aa4f944544fe9c398fbaa8dc1c7b7aa4189e6d019fdc2d1804d9e037b53fcc0bea36ecd8f9daf6e9e89bcaedaa0
SSDEEP

768:+OvUgJB0ofUmaDceJQERbWNv99VEtAs7cH7ZU:DvHJB0oUDpRCBatVe

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2892	2888	rundll32.exe	14
PID 2888 wrote to memory of 2892	2888	rundll32.exe	14
PID 2888 wrote to memory of 2892	2888	rundll32.exe	14
PID 2888 wrote to memory of 2892	2888	rundll32.exe	14
PID 2888 wrote to memory of 2892	2888	rundll32.exe	14
PID 2888 wrote to memory of 2892	2888	rundll32.exe	14
PID 2888 wrote to memory of 2892	2888	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\232c31d5696e1f99111782ec7f4641ef.dll,#1
1⤵
PID:2892

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\232c31d5696e1f99111782ec7f4641ef.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2892-3-0x0000000000180000-0x0000000000185000-memory.dmp

Filesize
20KB

Download
memory/2892-2-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2892-1-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2892-0-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download