5fdf0e7d45767c249433555f9d5f0c1bfbacaca7bc4a33bd34ab9c0540f13223 | Triage

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 09:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

435554cbe96ec406f294860f45b76602.dll
Size

220KB
MD5

435554cbe96ec406f294860f45b76602
SHA1

a597c99e769ffe4da463382d7b84f5f539c4f60e
SHA256

5fdf0e7d45767c249433555f9d5f0c1bfbacaca7bc4a33bd34ab9c0540f13223
SHA512

4246cbbfb7e6ea26bf3d3e9912b534075bad8b2f62d1676256e80f136586edc1af1433c264591899b4fdea130d1f6683428ab85fbe97a38a54871bef15e643e6
SSDEEP

6144:GFchTNcjuTV6W5rbw9KZe66vaIhuzQoOh:uchTNc6TV6MI6bzQoOh

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 2692	2424	rundll32.exe	28
PID 2424 wrote to memory of 2692	2424	rundll32.exe	28
PID 2424 wrote to memory of 2692	2424	rundll32.exe	28
PID 2424 wrote to memory of 2692	2424	rundll32.exe	28
PID 2424 wrote to memory of 2692	2424	rundll32.exe	28
PID 2424 wrote to memory of 2692	2424	rundll32.exe	28
PID 2424 wrote to memory of 2692	2424	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\435554cbe96ec406f294860f45b76602.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\435554cbe96ec406f294860f45b76602.dll,#1
  2⤵
  PID:2692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2692-1-0x0000000010000000-0x0000000010046000-memory.dmp

Filesize
280KB

Download
memory/2692-0-0x0000000010000000-0x0000000010046000-memory.dmp

Filesize
280KB

Download