484f9362f377321639393c1446d192235dd42756a32027cc81d237d14d73617b | Triage

Analysis

max time kernel
120s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10-01-2024 08:28

Sharing

Report Analysis Logs

General

Target

50145fad2f91a7e129d0c3cbb9aed13b.dll
Size

13KB
MD5

50145fad2f91a7e129d0c3cbb9aed13b
SHA1

f583b88c2e09d3f869f8569170da9abd9745570a
SHA256

484f9362f377321639393c1446d192235dd42756a32027cc81d237d14d73617b
SHA512

88c9720ed69588cc12e9fc249d16a6a0ff98bcb9ff6992045acf6cfcdeceba4ddcb10faa1c71505eeb6e93e81d66f41d461865c091ac8530384e8866a1943f88
SSDEEP

384:MQZH0zNPWwfI5cyoaSVVuqbbJ+ujzlm+M7in:dZHM8caSTvXYEX

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2216 wrote to memory of 1476	2216	rundll32.exe	rundll32.exe
PID 2216 wrote to memory of 1476	2216	rundll32.exe	rundll32.exe
PID 2216 wrote to memory of 1476	2216	rundll32.exe	rundll32.exe
PID 2216 wrote to memory of 1476	2216	rundll32.exe	rundll32.exe
PID 2216 wrote to memory of 1476	2216	rundll32.exe	rundll32.exe
PID 2216 wrote to memory of 1476	2216	rundll32.exe	rundll32.exe
PID 2216 wrote to memory of 1476	2216	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\50145fad2f91a7e129d0c3cbb9aed13b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2216

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\50145fad2f91a7e129d0c3cbb9aed13b.dll,#1
2⤵
PID:1476

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...