c0d7e8fdc01774859e64b3bf827cefa7800391db0b8fe52028ea738182f18ad4 | Triage

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
08-01-2024 15:44

Sharing

Report Analysis Logs

General

Target

4bd3b41d373e85a5478838040fc56f50.dll
Size

54KB
MD5

4bd3b41d373e85a5478838040fc56f50
SHA1

d11b606daf2f2909320afc672797372683c1362e
SHA256

c0d7e8fdc01774859e64b3bf827cefa7800391db0b8fe52028ea738182f18ad4
SHA512

8f88346f6ee4b706ccddb46e60190d4b29d0318d5d6ae517a61bf4ccb03cb0e77c11f7691d437af12603c75ddcce80202efddabebde17bf96e95e32eb0be072f
SSDEEP

1536:81EAiXqlalXCloEQc1g6m6W6xVKV4OQrnP:81EAiXqlalGoEnqCPs4OQj

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2372 wrote to memory of 2232	2372	rundll32.exe	rundll32.exe
PID 2372 wrote to memory of 2232	2372	rundll32.exe	rundll32.exe
PID 2372 wrote to memory of 2232	2372	rundll32.exe	rundll32.exe
PID 2372 wrote to memory of 2232	2372	rundll32.exe	rundll32.exe
PID 2372 wrote to memory of 2232	2372	rundll32.exe	rundll32.exe
PID 2372 wrote to memory of 2232	2372	rundll32.exe	rundll32.exe
PID 2372 wrote to memory of 2232	2372	rundll32.exe	rundll32.exe

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bd3b41d373e85a5478838040fc56f50.dll,#1
1⤵
PID:2232

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bd3b41d373e85a5478838040fc56f50.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2372

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...