aa912b656aeb0bfddea1e01d68fb040c90ca01232c5a0650b73f6ae615377f74 | Triage

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 13:44

Sharing

Report Analysis Logs

General

Target

4921eaa712f340b0a9ab3344505388c9.dll
Size

241KB
MD5

4921eaa712f340b0a9ab3344505388c9
SHA1

4539cc7c8369475e22e181b778ee141ffeb4e3e9
SHA256

aa912b656aeb0bfddea1e01d68fb040c90ca01232c5a0650b73f6ae615377f74
SHA512

bd2180721cf66f34165d667e7f455349163d0b7d0db09dafb67f0232c4861239b63048c1d05d30153fd3742c5a17a7dfe6059b5b5290d97fd31b0fb0cb02c7d9
SSDEEP

6144:oqTrecAn327nq5Ka+WmbV7I+Caq7HMCtJXPpg:oqeDGO5KmmJ9bkMCtJXRg

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 2188	836	rundll32.exe	28
PID 836 wrote to memory of 2188	836	rundll32.exe	28
PID 836 wrote to memory of 2188	836	rundll32.exe	28
PID 836 wrote to memory of 2188	836	rundll32.exe	28
PID 836 wrote to memory of 2188	836	rundll32.exe	28
PID 836 wrote to memory of 2188	836	rundll32.exe	28
PID 836 wrote to memory of 2188	836	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4921eaa712f340b0a9ab3344505388c9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4921eaa712f340b0a9ab3344505388c9.dll,#1
  2⤵
  PID:2188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2188-1-0x00000000007A0000-0x000000000086A000-memory.dmp

Filesize
808KB

Download
memory/2188-0-0x00000000007A0000-0x000000000086A000-memory.dmp

Filesize
808KB

Download
memory/2188-2-0x00000000007A0000-0x000000000086A000-memory.dmp

Filesize
808KB

Download
memory/2188-3-0x00000000007A0000-0x0000000000861000-memory.dmp

Filesize
772KB

Download