0da567c2ba018ae2f40b40dc1f48254898bde8689f464b04026c1391d63b9492 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 07:21

Sharing

Report Analysis Logs

General

Target

2d31ed7ffceeaf0c483ff745bedaffa7.dll
Size

72KB
MD5

2d31ed7ffceeaf0c483ff745bedaffa7
SHA1

d6dd526717776bde538d40337b3942a57ad6c410
SHA256

0da567c2ba018ae2f40b40dc1f48254898bde8689f464b04026c1391d63b9492
SHA512

bbe1b3d049baee305282d8745b3228763e8b0bc9d4d00d133ae91d5f4fc5dc4cfb9d1f28260e7cf7120e83e535583c59286819ba3188e97a552824d7272e6913
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 3012	2652	rundll32.exe	17
PID 2652 wrote to memory of 3012	2652	rundll32.exe	17
PID 2652 wrote to memory of 3012	2652	rundll32.exe	17
PID 2652 wrote to memory of 3012	2652	rundll32.exe	17
PID 2652 wrote to memory of 3012	2652	rundll32.exe	17
PID 2652 wrote to memory of 3012	2652	rundll32.exe	17
PID 2652 wrote to memory of 3012	2652	rundll32.exe	17

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d31ed7ffceeaf0c483ff745bedaffa7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d31ed7ffceeaf0c483ff745bedaffa7.dll,#1
  2⤵
  PID:3012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads