58dc3f29aaf0b2dde4d393351b91f5a5757780024903a07a3ad7f7196e2d5568 | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05-01-2024 00:40

Sharing

Report Analysis Logs

General

Target

4253fe2045d409ea9298089020b8fd9a.dll
Size

136KB
MD5

4253fe2045d409ea9298089020b8fd9a
SHA1

301354ee09b0e13bc96791de86f00ca3bae08588
SHA256

58dc3f29aaf0b2dde4d393351b91f5a5757780024903a07a3ad7f7196e2d5568
SHA512

9361d4e615e47bc1f62b94cbfb4b74c3604a65e2a8fda2536f5966b777057b4359ff419f312a2fd61a8b4123d59dda1bb1314c428154babd22582d7a3d39b232
SSDEEP

3072:hzjnfsD31Oc9HCDdI6oKxOXO2PbnrmsofoK8Zx:hzrC319YDbwnbCnCx

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 1888	1660	rundll32.exe	14
PID 1660 wrote to memory of 1888	1660	rundll32.exe	14
PID 1660 wrote to memory of 1888	1660	rundll32.exe	14
PID 1660 wrote to memory of 1888	1660	rundll32.exe	14
PID 1660 wrote to memory of 1888	1660	rundll32.exe	14
PID 1660 wrote to memory of 1888	1660	rundll32.exe	14
PID 1660 wrote to memory of 1888	1660	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4253fe2045d409ea9298089020b8fd9a.dll,#1
1⤵
PID:1888

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4253fe2045d409ea9298089020b8fd9a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1888-0-0x0000000000170000-0x000000000017A000-memory.dmp

Filesize
40KB

Download
memory/1888-6-0x0000000000170000-0x000000000017A000-memory.dmp

Filesize
40KB

Download
memory/1888-5-0x0000000000170000-0x000000000017A000-memory.dmp

Filesize
40KB

Download
memory/1888-2-0x0000000010000000-0x000000001002B000-memory.dmp

Filesize
172KB

Download