56a068fa91ddd56c69c59f0cd28ab45e7c99084885638beb11707d067f124f9b | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 13:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

38d97f599651f5f831a44ddd4fb1f97c.dll
Size

8KB
MD5

38d97f599651f5f831a44ddd4fb1f97c
SHA1

35bebfcd8541b3ee57f0e98db60dda4da50a2929
SHA256

56a068fa91ddd56c69c59f0cd28ab45e7c99084885638beb11707d067f124f9b
SHA512

63fd21596be90755b638a047ad6d4a936661b94042902fcf13138063c9176ca44a6920cd8ee77fca162bb58b82c99a6206aef7594cada4cb4a275cb2c368323b
SSDEEP

192:NG1npT656zYG9iUPcTmyR4Mx3X+EqZY6g:NmO6EPUPcyyR3Nu2

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 1216	2220	rundll32.exe	16
PID 2220 wrote to memory of 1216	2220	rundll32.exe	16
PID 2220 wrote to memory of 1216	2220	rundll32.exe	16
PID 2220 wrote to memory of 1216	2220	rundll32.exe	16
PID 2220 wrote to memory of 1216	2220	rundll32.exe	16
PID 2220 wrote to memory of 1216	2220	rundll32.exe	16
PID 2220 wrote to memory of 1216	2220	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\38d97f599651f5f831a44ddd4fb1f97c.dll,#1
1⤵
PID:1216

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\38d97f599651f5f831a44ddd4fb1f97c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads