90470d54e974e45d53e9fc86c06f43a1a770b3a27161eb6a48f4cc69b7bc736b | Triage

Analysis

max time kernel
122s
max time network
161s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 04:40

Sharing

Report Analysis Logs

General

Target

288e5089e026419591e04f9311072b3b.dll
Size

37KB
MD5

288e5089e026419591e04f9311072b3b
SHA1

f3c60e6d460849b988c7f652b99db9496e69659d
SHA256

90470d54e974e45d53e9fc86c06f43a1a770b3a27161eb6a48f4cc69b7bc736b
SHA512

bdfa19b7dff7cf5842e20d1d1b32565b18e60a73cee970ca1a63018035ebd310b8543f822113e859a6600b2419b5841c8c2925007a53cd401daff16c76a93e4b
SSDEEP

768:38XScD1GgWStNQJVlwsT9WTqoc3a8qJzNV:sSm1GgNoCKWokRV

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2680	2792	rundll32.exe	29
PID 2792 wrote to memory of 2680	2792	rundll32.exe	29
PID 2792 wrote to memory of 2680	2792	rundll32.exe	29
PID 2792 wrote to memory of 2680	2792	rundll32.exe	29
PID 2792 wrote to memory of 2680	2792	rundll32.exe	29
PID 2792 wrote to memory of 2680	2792	rundll32.exe	29
PID 2792 wrote to memory of 2680	2792	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\288e5089e026419591e04f9311072b3b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\288e5089e026419591e04f9311072b3b.dll,#1
  2⤵
  PID:2680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads