79363059a6975e6cdebca0536e6394220649911f13adb2a9b359eb6d9ec5fdd7 | Triage

Analysis

max time kernel
121s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 18:57

Sharing

Report Analysis Logs

General

Target

3accb31a205d729d33c9e957e1657ad8.dll
Size

28KB
MD5

3accb31a205d729d33c9e957e1657ad8
SHA1

60ba2714299aa8c8208ad40f6698b8eed9d49174
SHA256

79363059a6975e6cdebca0536e6394220649911f13adb2a9b359eb6d9ec5fdd7
SHA512

c2146060c5ae390fe8e828636e9e1f622de2f2d72ffe5fd348102542a93f7e387cfdbdcf61b4a6a875e5b13b2b9aa84f026622019ee7416e27b854c8882f13b5
SSDEEP

768:ddW6junwdlw/8yHHph1J/+XFi2Evx2hVs/86i:dd9j1dl/4f1J/72EvxgQ8X

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 2444	2680	rundll32.exe	28
PID 2680 wrote to memory of 2444	2680	rundll32.exe	28
PID 2680 wrote to memory of 2444	2680	rundll32.exe	28
PID 2680 wrote to memory of 2444	2680	rundll32.exe	28
PID 2680 wrote to memory of 2444	2680	rundll32.exe	28
PID 2680 wrote to memory of 2444	2680	rundll32.exe	28
PID 2680 wrote to memory of 2444	2680	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3accb31a205d729d33c9e957e1657ad8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3accb31a205d729d33c9e957e1657ad8.dll,#1
  2⤵
  PID:2444

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2444-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download