2e7d7b27cc10865ec115d1049d07e3f6d2d304a83c2e2884c748ce401760bae5 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 23:38

Sharing

Report Analysis Logs

General

Target

4a1379adc469737340bec020bb92a872.dll
Size

32KB
MD5

4a1379adc469737340bec020bb92a872
SHA1

020c7a267a6cfe293ea01f8c6a22e63fc949cb48
SHA256

2e7d7b27cc10865ec115d1049d07e3f6d2d304a83c2e2884c748ce401760bae5
SHA512

af3438e1f3bd4225f2c6103a8140a8f34006d508ede97bdd68cf62e1f7752df3a2dac5811d9667a5be02a5c992da6d027c5bdd83904341379a143e286fce8924
SSDEEP

768:ICz5XrioyuJendIB+Mh1o7CqkSDjOTkMOasDSruCwrAZ:/5undIXmkSOzQ9cZ

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2992	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2992	2988	rundll32.exe	16
PID 2988 wrote to memory of 2992	2988	rundll32.exe	16
PID 2988 wrote to memory of 2992	2988	rundll32.exe	16
PID 2988 wrote to memory of 2992	2988	rundll32.exe	16
PID 2988 wrote to memory of 2992	2988	rundll32.exe	16
PID 2988 wrote to memory of 2992	2988	rundll32.exe	16
PID 2988 wrote to memory of 2992	2988	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a1379adc469737340bec020bb92a872.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4a1379adc469737340bec020bb92a872.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2992-1-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download
memory/2992-2-0x0000000000180000-0x0000000000182000-memory.dmp

Filesize
8KB

Download
memory/2992-0-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download