59db8a5a174eddf4ab5a4207b5c5779aef175f594a12df493c7e2bd7124712ba | Triage

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 03:45

Sharing

Report Analysis Logs

General

Target

26d7caa0faf92c63cdd16f0ca20704f6.dll
Size

6KB
MD5

26d7caa0faf92c63cdd16f0ca20704f6
SHA1

4a924731782dda7c1e5529e18abf9fd4b025897d
SHA256

59db8a5a174eddf4ab5a4207b5c5779aef175f594a12df493c7e2bd7124712ba
SHA512

1273653615f797e269cae16fd92e127eeff8e6e46d855cce2e6a4236a01fd43779987f7f3540336de46def5fe684d08d148c3d0099f80dc04d3b1ff440c759b3
SSDEEP

48:63mll5YVOa9VUX1iwbQWu0SB+BDq9J5SH:VDa9VUX9bQWyB+FqX5SH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2724	2732	rundll32.exe	27
PID 2732 wrote to memory of 2724	2732	rundll32.exe	27
PID 2732 wrote to memory of 2724	2732	rundll32.exe	27
PID 2732 wrote to memory of 2724	2732	rundll32.exe	27
PID 2732 wrote to memory of 2724	2732	rundll32.exe	27
PID 2732 wrote to memory of 2724	2732	rundll32.exe	27
PID 2732 wrote to memory of 2724	2732	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\26d7caa0faf92c63cdd16f0ca20704f6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\26d7caa0faf92c63cdd16f0ca20704f6.dll,#1
  2⤵
  PID:2724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads