7c2d6cd7f8059b75da9b6653c7c228525edc727adb6ad1cce737c9bc8178a2d8 | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 03:21

Sharing

Report Analysis Logs

General

Target

2630866fa4eefc08526b1ea367a41235.dll
Size

939KB
MD5

2630866fa4eefc08526b1ea367a41235
SHA1

7699c4cf324049c0d7dbcb15f5fe2a8b0abc6134
SHA256

7c2d6cd7f8059b75da9b6653c7c228525edc727adb6ad1cce737c9bc8178a2d8
SHA512

a93bc9c9559dd5c05d9ab692a3661f4b66cb34cdb3e075763a727b16529be2231d490fa72f76eb1bdbe92f46d560eb384e17fda1bf4dd57edcdaa59795ec880f
SSDEEP

24576:8nFb2J268avVEBRfX9/76ZDCw2blywTXHWy:WJ2f3iRfX9/GZDCBywL

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 1756	3028	rundll32.exe	28
PID 3028 wrote to memory of 1756	3028	rundll32.exe	28
PID 3028 wrote to memory of 1756	3028	rundll32.exe	28
PID 3028 wrote to memory of 1756	3028	rundll32.exe	28
PID 3028 wrote to memory of 1756	3028	rundll32.exe	28
PID 3028 wrote to memory of 1756	3028	rundll32.exe	28
PID 3028 wrote to memory of 1756	3028	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2630866fa4eefc08526b1ea367a41235.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2630866fa4eefc08526b1ea367a41235.dll,#1
  2⤵
  PID:1756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1756-0-0x0000000020000000-0x0000000020008000-memory.dmp

Filesize
32KB

Download