48ec84cc5cae76a524ec726192f646da684d44448e3e715ccd03a9bc14ead63c | Triage

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 14:15

Sharing

Report Analysis Logs

General

Target

3973fe4a509c40b8ee50a92f9dfbde98.dll
Size

12KB
MD5

3973fe4a509c40b8ee50a92f9dfbde98
SHA1

7abf77509a3e6b8e4b8233c6794de6a78f96e17b
SHA256

48ec84cc5cae76a524ec726192f646da684d44448e3e715ccd03a9bc14ead63c
SHA512

e23900391fa2bebe5e916adafb74f8e7a28d69eebb0060dda2031416379ef4455e6281da709ed5469b168ca5a5edbeb81f4d2e40fc1c326de2f7e6359f7abfde
SSDEEP

192:nnVwYHQvSSKPcTnpspF11kqJKfI8vfsmf0b77:VwYjQnIF16q2Nfs60P7

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 1708	1216	rundll32.exe	28
PID 1216 wrote to memory of 1708	1216	rundll32.exe	28
PID 1216 wrote to memory of 1708	1216	rundll32.exe	28
PID 1216 wrote to memory of 1708	1216	rundll32.exe	28
PID 1216 wrote to memory of 1708	1216	rundll32.exe	28
PID 1216 wrote to memory of 1708	1216	rundll32.exe	28
PID 1216 wrote to memory of 1708	1216	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3973fe4a509c40b8ee50a92f9dfbde98.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3973fe4a509c40b8ee50a92f9dfbde98.dll,#1
  2⤵
  PID:1708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads