c5c74a3e56f443204b56ad5835ea1fb23f2898744ade6a4a1756d7a366ad5607 | Triage

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 13:58

Sharing

Report Analysis Logs

General

Target

38ec18d7c140565632027f2691df2775.dll
Size

72KB
MD5

38ec18d7c140565632027f2691df2775
SHA1

1750ea8eec08352ba956d61db846385f6d95cc30
SHA256

c5c74a3e56f443204b56ad5835ea1fb23f2898744ade6a4a1756d7a366ad5607
SHA512

522e0e0260daf6ade56718c59eff837ecb34f78e6cebeda28a2d44a518f47c0bcd4ba81ebc880dd244a59d8247fe84380e4560c276cc4a0f6a8cc046a2f68f05
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2312	2888	rundll32.exe	28
PID 2888 wrote to memory of 2312	2888	rundll32.exe	28
PID 2888 wrote to memory of 2312	2888	rundll32.exe	28
PID 2888 wrote to memory of 2312	2888	rundll32.exe	28
PID 2888 wrote to memory of 2312	2888	rundll32.exe	28
PID 2888 wrote to memory of 2312	2888	rundll32.exe	28
PID 2888 wrote to memory of 2312	2888	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\38ec18d7c140565632027f2691df2775.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\38ec18d7c140565632027f2691df2775.dll,#1
  2⤵
  PID:2312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads