9c05d46eab40f842ca40b635ce5f23dd7e97062937a26a9647e0c0bb811a7a3d | Triage

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 08:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4dd0db0995f53190deefef1505b9fda9.dll
Size

28KB
MD5

4dd0db0995f53190deefef1505b9fda9
SHA1

f8c29e2acb7b0eec75002ad3e1a1e826fa6a15ae
SHA256

9c05d46eab40f842ca40b635ce5f23dd7e97062937a26a9647e0c0bb811a7a3d
SHA512

60e6d38def8b423cb2b85b25e57b599d026ac4e4da37376b01260c33ebac5fb13de2a06305121715cee69e91e9e1efce81c5f80a27cd9e6b551ac53f3d52dc32
SSDEEP

384:hAlUnnItYMvZ2iZF47bkPuPDjPrUZ637tIoyi6:bItFWPkPuPDjPrk63Bz6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 1560	2340	rundll32.exe	28
PID 2340 wrote to memory of 1560	2340	rundll32.exe	28
PID 2340 wrote to memory of 1560	2340	rundll32.exe	28
PID 2340 wrote to memory of 1560	2340	rundll32.exe	28
PID 2340 wrote to memory of 1560	2340	rundll32.exe	28
PID 2340 wrote to memory of 1560	2340	rundll32.exe	28
PID 2340 wrote to memory of 1560	2340	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4dd0db0995f53190deefef1505b9fda9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4dd0db0995f53190deefef1505b9fda9.dll,#1
  2⤵
  PID:1560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads