aa8de68367c27b7e40397574a5cc2a52c59260cb326c699416e6d66cc0d970e5 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 07:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2cf360524f438f87931d6a102449d07e.dll
Size

26KB
MD5

2cf360524f438f87931d6a102449d07e
SHA1

81d50dd48c9802926f403372a6259f25e470614b
SHA256

aa8de68367c27b7e40397574a5cc2a52c59260cb326c699416e6d66cc0d970e5
SHA512

d0bf4aa8c672e0300a4a4cc3bbe7167d48463fd9a04b97507bab7438bf3b1402b42f271322f5924f2693c13b9e9d3ac4dbc67ebbbe2849cbe45bb2439ff26db2
SSDEEP

768:OHHfGR7CK0mCH2K9UYBu99cFrqT9bOXGS:Ofih0mU2K9U19WqwXG

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2980	2964	rundll32.exe	16
PID 2964 wrote to memory of 2980	2964	rundll32.exe	16
PID 2964 wrote to memory of 2980	2964	rundll32.exe	16
PID 2964 wrote to memory of 2980	2964	rundll32.exe	16
PID 2964 wrote to memory of 2980	2964	rundll32.exe	16
PID 2964 wrote to memory of 2980	2964	rundll32.exe	16
PID 2964 wrote to memory of 2980	2964	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cf360524f438f87931d6a102449d07e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cf360524f438f87931d6a102449d07e.dll,#1
  2⤵
  PID:2980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2980-3-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/2980-2-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/2980-1-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/2980-0-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download