99c26c4d8369870729694df2adae9bbb20e1644d579594e2d84e7bbd3f68450b | Triage

Analysis

max time kernel
0s
max time network
1s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 09:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

435c95968bae518f0154467f1a038bd2.dll
Size

25KB
MD5

435c95968bae518f0154467f1a038bd2
SHA1

9a05a388781a0e19d970754ac4b0abccff869700
SHA256

99c26c4d8369870729694df2adae9bbb20e1644d579594e2d84e7bbd3f68450b
SHA512

47b2f9f279e5dc8af70455c712084b1252cec23a81a513c794344413070c6c958d803de977543cc19d3ab2eb2cb8a0e89c4b8b36623be30957624327c805a15f
SSDEEP

768:AGzATDOsUv3PYu1uVuS2177vAVM9JVYuGpO+N:o3OsU/PpvlgMtxGb

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2932	2916	rundll32.exe	28
PID 2916 wrote to memory of 2932	2916	rundll32.exe	28
PID 2916 wrote to memory of 2932	2916	rundll32.exe	28
PID 2916 wrote to memory of 2932	2916	rundll32.exe	28
PID 2916 wrote to memory of 2932	2916	rundll32.exe	28
PID 2916 wrote to memory of 2932	2916	rundll32.exe	28
PID 2916 wrote to memory of 2932	2916	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\435c95968bae518f0154467f1a038bd2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\435c95968bae518f0154467f1a038bd2.dll,#1
  2⤵
  PID:2932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2932-0-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2932-1-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2932-2-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download