e099c92ab5765f5551fbec06839ef55a5e0b4bcbd0793a33574703b539224546 | Triage

Analysis

max time kernel
119s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 06:11

Sharing

Report Analysis Logs

General

Target

483b3bee826ff52d77977c2f96158634.dll
Size

13KB
MD5

483b3bee826ff52d77977c2f96158634
SHA1

23d446ec03c2a86200553f0169ae801378294bd3
SHA256

e099c92ab5765f5551fbec06839ef55a5e0b4bcbd0793a33574703b539224546
SHA512

71945d145176a46080a170dc4e4b794cd2aa64f37ca8c3b978f66d2c26c84394a93ab722ee87a768a4da2bf7c3420fd20e082dbd7a2ffbed1326d7ae2f455937
SSDEEP

384:t0nm2z4TAyrgBnlBKZBi9e2HcZeysBQyqsz:t0m8OO7BKZQe28YBQMz

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2884	3012	rundll32.exe	28
PID 3012 wrote to memory of 2884	3012	rundll32.exe	28
PID 3012 wrote to memory of 2884	3012	rundll32.exe	28
PID 3012 wrote to memory of 2884	3012	rundll32.exe	28
PID 3012 wrote to memory of 2884	3012	rundll32.exe	28
PID 3012 wrote to memory of 2884	3012	rundll32.exe	28
PID 3012 wrote to memory of 2884	3012	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\483b3bee826ff52d77977c2f96158634.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\483b3bee826ff52d77977c2f96158634.dll,#1
  2⤵
  PID:2884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2884-0-0x0000000068980000-0x000000006898A000-memory.dmp

Filesize
40KB

Download
memory/2884-1-0x0000000068980000-0x000000006898A000-memory.dmp

Filesize
40KB

Download
memory/2884-2-0x0000000068980000-0x000000006898A000-memory.dmp

Filesize
40KB

Download