a3924df964a4e90c60ab76c7627706dd4986c06c3c513b9dae66d2cb9dc80fe1 | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 08:01

Sharing

Report Analysis Logs

General

Target

lib/ImportDDS.dll
Size

36KB
MD5

40d8d6572abf537677427cf2e44e3c3d
SHA1

34c87824767848f2c6b0cd93c2a137d53f936207
SHA256

64e75710a4978fbf6723ff2a6eb613e74342db0ee403adaa1bc87010a60d3b74
SHA512

d0ed810fe18ebc91d036ffcb3c3462ffcbd34420a2ce802212efca65a266119bfa53a17124746fb82945fa772b3456eae65cded223e52bedb090ecddd5c64e9b
SSDEEP

384:rEzQJoPg1ZXl+s2VbjM4BVZL0bF48YrLD1LZo8MPHXO5v79Xq:roMjL+s2Vg2VZLACo8iHXi7Fq

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 2860	2840	rundll32.exe	28
PID 2840 wrote to memory of 2860	2840	rundll32.exe	28
PID 2840 wrote to memory of 2860	2840	rundll32.exe	28
PID 2840 wrote to memory of 2860	2840	rundll32.exe	28
PID 2840 wrote to memory of 2860	2840	rundll32.exe	28
PID 2840 wrote to memory of 2860	2840	rundll32.exe	28
PID 2840 wrote to memory of 2860	2840	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\ImportDDS.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\ImportDDS.dll,#1
  2⤵
  PID:2860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2860-0-0x0000000000120000-0x0000000000144000-memory.dmp

Filesize
144KB

Download
memory/2860-2-0x0000000000150000-0x0000000000167000-memory.dmp

Filesize
92KB

Download