87dfa7c18eed8118bb2528cae34a837263f3cd3fab13a7d2e8782db47683c4ef | Triage

Analysis

max time kernel
120s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 14:29

Sharing

Report Analysis Logs

General

Target

39dbb803930d1754cc4fa5c878283bc6.dll
Size

33KB
MD5

39dbb803930d1754cc4fa5c878283bc6
SHA1

74937b8b98e3745c63d989737361bd19b5e937ce
SHA256

87dfa7c18eed8118bb2528cae34a837263f3cd3fab13a7d2e8782db47683c4ef
SHA512

4e5b5fd0106fa78696c3e431e8c18fbe5050c0302bc9232eeb10315e6f467ab59415879692f934156b02955e5b5a3b2169683b7dc018392ea856087880b71b74
SSDEEP

768:VTVGB7Yl9lAog4NXCs00XQFFeTa751mnP0IaLAMbM:VJ00XTgiSsH6nPoP0nkMbM

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2868	2420	rundll32.exe	14
PID 2420 wrote to memory of 2868	2420	rundll32.exe	14
PID 2420 wrote to memory of 2868	2420	rundll32.exe	14
PID 2420 wrote to memory of 2868	2420	rundll32.exe	14
PID 2420 wrote to memory of 2868	2420	rundll32.exe	14
PID 2420 wrote to memory of 2868	2420	rundll32.exe	14
PID 2420 wrote to memory of 2868	2420	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\39dbb803930d1754cc4fa5c878283bc6.dll,#1
1⤵
PID:2868

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\39dbb803930d1754cc4fa5c878283bc6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads