c6eb1f582e8a82d066f041261b0b082695d5b057d17dcc3363e3547444362ed9 | Triage

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 06:33

Sharing

Report Analysis Logs

General

Target

2bd33bd248a21d3f6ab7495eeb3dc092.dll
Size

48KB
MD5

2bd33bd248a21d3f6ab7495eeb3dc092
SHA1

86d6055b2599b2ce0e6b77403ef07a59e39997fe
SHA256

c6eb1f582e8a82d066f041261b0b082695d5b057d17dcc3363e3547444362ed9
SHA512

be307f5cfd9aadf7a64469e97144691ab5d7455b826da09acb17fcc204ddc2588b3a4186b6115f7a54c6b13caee453ec3d7dd1e2c21538efab213a37422a3607
SSDEEP

768:5NesDjA2VtTvRPrOEKZe8eeAnbNufsoiGgqKFeJ:jes3TvRrOjpAnailqK4J

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2328	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 2328	928	rundll32.exe	28
PID 928 wrote to memory of 2328	928	rundll32.exe	28
PID 928 wrote to memory of 2328	928	rundll32.exe	28
PID 928 wrote to memory of 2328	928	rundll32.exe	28
PID 928 wrote to memory of 2328	928	rundll32.exe	28
PID 928 wrote to memory of 2328	928	rundll32.exe	28
PID 928 wrote to memory of 2328	928	rundll32.exe	28
PID 2328 wrote to memory of 1216	2328	rundll32.exe	13

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1216
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2bd33bd248a21d3f6ab7495eeb3dc092.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:928
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\2bd33bd248a21d3f6ab7495eeb3dc092.dll,#1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1216-0-0x0000000002A60000-0x0000000002A61000-memory.dmp

Filesize
4KB

Download