b8980c20b6e3514c70b112d8c4c9bc23e197ba877fff9cb5939c7399dc66dd85 | Triage

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 10:44

Sharing

Report Analysis Logs

General

Target

437ad2d99d3dfb452dcdfc72f7f4b61f.dll
Size

59KB
MD5

437ad2d99d3dfb452dcdfc72f7f4b61f
SHA1

e67f5723a9d9f55d663fe64f41f8642392065bd4
SHA256

b8980c20b6e3514c70b112d8c4c9bc23e197ba877fff9cb5939c7399dc66dd85
SHA512

7fc4a88f6af21bbb576c6381d690a1eaebbda49704f2fe02685e2e25d565ccf5adb9a9317306c7571a409fee0e202d6d1b65850cd36e30134f2c911e87b8a4d4
SSDEEP

1536:GQ3tfgXKoKGf4UGHcSHqBYn4aQc4CQpueGi+n4pz8:VfgXK4zKcSKyCCuuGQ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 2024	1808	rundll32.exe	14
PID 1808 wrote to memory of 2024	1808	rundll32.exe	14
PID 1808 wrote to memory of 2024	1808	rundll32.exe	14
PID 1808 wrote to memory of 2024	1808	rundll32.exe	14
PID 1808 wrote to memory of 2024	1808	rundll32.exe	14
PID 1808 wrote to memory of 2024	1808	rundll32.exe	14
PID 1808 wrote to memory of 2024	1808	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\437ad2d99d3dfb452dcdfc72f7f4b61f.dll,#1
1⤵
PID:2024

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\437ad2d99d3dfb452dcdfc72f7f4b61f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads