26ea93bdffbd273fad7b867d1f4a5d6a38ff5c26deaf2e35efbc4208898eb852 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
10-01-2024 08:58

Sharing

Report Analysis Logs

General

Target

5024ae93b9166b61d691b54bd0339eaa.dll
Size

35KB
MD5

5024ae93b9166b61d691b54bd0339eaa
SHA1

912788e988abfe1560550e7abb2123ce6c1eb76e
SHA256

26ea93bdffbd273fad7b867d1f4a5d6a38ff5c26deaf2e35efbc4208898eb852
SHA512

7b8e287094c88b938f13efd309ac22c5fc3bbe09b6c2f0322c0ad38d9616b29a1737c05fb00f300c71fe23e2b90911386ba5286a3dca0d02f5d0048fa7b31c13
SSDEEP

768:+erqX1szZeNYD5yjbTEQVSZ8m9FEP03Ur:lrqX1s4N3aZo0

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 1704	756	rundll32.exe	14
PID 756 wrote to memory of 1704	756	rundll32.exe	14
PID 756 wrote to memory of 1704	756	rundll32.exe	14
PID 756 wrote to memory of 1704	756	rundll32.exe	14
PID 756 wrote to memory of 1704	756	rundll32.exe	14
PID 756 wrote to memory of 1704	756	rundll32.exe	14
PID 756 wrote to memory of 1704	756	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5024ae93b9166b61d691b54bd0339eaa.dll,#1
1⤵
PID:1704

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5024ae93b9166b61d691b54bd0339eaa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1704-0-0x0000000000130000-0x0000000000141000-memory.dmp

Filesize
68KB

Download