73c360cc6a6302276abb2884699b4eaddb22dba5597ae612df7d7755fa84eca2 | Triage

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3a4447a25026165e746ec02cf1b5c452.dll
Size

57KB
MD5

3a4447a25026165e746ec02cf1b5c452
SHA1

95e5a578c923bba2871af4fa7f95a8f32b8afa9f
SHA256

73c360cc6a6302276abb2884699b4eaddb22dba5597ae612df7d7755fa84eca2
SHA512

cb92675a7a45d8e841311fe49e027ee093edebaa115fd6b62c6df07e007d84de1ec0b228141663c7651bbbe95bb4af5e0a191703781b8d4ac518fb200f2de435
SSDEEP

1536:p9fTly+WPR6pJpXQGAa5jRIx3YCdIoZLpqa8:HfTA+WPR6lHRgiSL78

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2208	2028	rundll32.exe	16
PID 2028 wrote to memory of 2208	2028	rundll32.exe	16
PID 2028 wrote to memory of 2208	2028	rundll32.exe	16
PID 2028 wrote to memory of 2208	2028	rundll32.exe	16
PID 2028 wrote to memory of 2208	2028	rundll32.exe	16
PID 2028 wrote to memory of 2208	2028	rundll32.exe	16
PID 2028 wrote to memory of 2208	2028	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a4447a25026165e746ec02cf1b5c452.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a4447a25026165e746ec02cf1b5c452.dll,#1
  2⤵
  PID:2208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2208-1-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/2208-0-0x00000000006E0000-0x0000000000730000-memory.dmp

Filesize
320KB

Download
memory/2208-2-0x00000000006E0000-0x0000000000730000-memory.dmp

Filesize
320KB

Download