19ceba999b226ed63189d7158fe2a2e5e151e73d032cd919bed1ad17822f0923 | Triage

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 01:30

Sharing

Report Analysis Logs

General

Target

426b809d9fec973b19c294daade50889.dll
Size

3KB
MD5

426b809d9fec973b19c294daade50889
SHA1

730568e107c5e5438bd3bb2bca8a3ef76be93bcf
SHA256

19ceba999b226ed63189d7158fe2a2e5e151e73d032cd919bed1ad17822f0923
SHA512

22382f6b8c2cb5e4b60c0f06daebc6cc4f3abffd36148a667b73583c0ef5010dad73d491c8abf8a1a04d43ee5d3169f219200b57c0201af4edfc6f5c9627d448

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 2716	1752	rundll32.exe	28
PID 1752 wrote to memory of 2716	1752	rundll32.exe	28
PID 1752 wrote to memory of 2716	1752	rundll32.exe	28
PID 1752 wrote to memory of 2716	1752	rundll32.exe	28
PID 1752 wrote to memory of 2716	1752	rundll32.exe	28
PID 1752 wrote to memory of 2716	1752	rundll32.exe	28
PID 1752 wrote to memory of 2716	1752	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\426b809d9fec973b19c294daade50889.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\426b809d9fec973b19c294daade50889.dll,#1
  2⤵
  PID:2716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads