50f031c33abea5057478d7eb1342049a09a4cbf571e44a1bfa00a6457bea988e | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 00:31

Sharing

Report Analysis Logs

General

Target

4f1aa8789ba03dc2a7fdc3a400ab63ac.dll
Size

72KB
MD5

4f1aa8789ba03dc2a7fdc3a400ab63ac
SHA1

0b8c0978e1514ba2530361a94d919f3aee407665
SHA256

50f031c33abea5057478d7eb1342049a09a4cbf571e44a1bfa00a6457bea988e
SHA512

bc58a90d4965d9af442a4b7911b4c93898c32e4f6b3714ef8f6dee5b8ce19dbec872968b564cb4dd0e87cf8241e4b4ee6a8874f92226be7340bd03be759853ee
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2924	3048	rundll32.exe	14
PID 3048 wrote to memory of 2924	3048	rundll32.exe	14
PID 3048 wrote to memory of 2924	3048	rundll32.exe	14
PID 3048 wrote to memory of 2924	3048	rundll32.exe	14
PID 3048 wrote to memory of 2924	3048	rundll32.exe	14
PID 3048 wrote to memory of 2924	3048	rundll32.exe	14
PID 3048 wrote to memory of 2924	3048	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4f1aa8789ba03dc2a7fdc3a400ab63ac.dll,#1
1⤵
PID:2924

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4f1aa8789ba03dc2a7fdc3a400ab63ac.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads