e00ca49c5cf280f93a38ab2e7675c2eb8afacaaa60e31daf3baab38219ea691c | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 06:49

Sharing

Report Analysis Logs

General

Target

2c399dac5b70c22b7f7dce1cd7708810.dll
Size

59KB
MD5

2c399dac5b70c22b7f7dce1cd7708810
SHA1

b9c875a7cf0e4fefefbcace92df75799b25e9438
SHA256

e00ca49c5cf280f93a38ab2e7675c2eb8afacaaa60e31daf3baab38219ea691c
SHA512

b10f0cce9044d9c21d4d54b23863a0bc661b9ea3f669119cdcb1f8d474514c25f1be7152613fa1e9fec5771a57c2ea9c31c38a3ab18a7eab501cf8f93b406cdf
SSDEEP

1536:PbmYvD1oaogB84RgpQRN1Dxy6RsXGptSXDfgjdNh7:DmaoVitWwtSXrg5f7

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2196	2876	rundll32.exe	28
PID 2876 wrote to memory of 2196	2876	rundll32.exe	28
PID 2876 wrote to memory of 2196	2876	rundll32.exe	28
PID 2876 wrote to memory of 2196	2876	rundll32.exe	28
PID 2876 wrote to memory of 2196	2876	rundll32.exe	28
PID 2876 wrote to memory of 2196	2876	rundll32.exe	28
PID 2876 wrote to memory of 2196	2876	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c399dac5b70c22b7f7dce1cd7708810.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c399dac5b70c22b7f7dce1cd7708810.dll,#1
  2⤵
  PID:2196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads