c640ff2e2c8c9ffd1f556098b83bedf3b2abc7dddbde85d8d26768e5f1d5e6bb | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 18:22

Sharing

Report Analysis Logs

General

Target

5146130e9f328c33400b2d4447ba120e.dll
Size

8KB
MD5

5146130e9f328c33400b2d4447ba120e
SHA1

f905aed12c4679ae8eb18b19537b5234d55fdfee
SHA256

c640ff2e2c8c9ffd1f556098b83bedf3b2abc7dddbde85d8d26768e5f1d5e6bb
SHA512

7732ad9a35cc2ffbbec9dd69c6074d16dfe3506fd04c165bd14442e1d262c22abe222ba604623a82b3dfd329d2d22d91f519fae7481ac5747e509b468ae0dc4e
SSDEEP

192:Pha4u/bXirjIzWTaJyvpFHJXCjNMdvyXErUkgUwud:Pg4NPIHJyxFpDvyXErrv

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2384	2288	rundll32.exe	14
PID 2288 wrote to memory of 2384	2288	rundll32.exe	14
PID 2288 wrote to memory of 2384	2288	rundll32.exe	14
PID 2288 wrote to memory of 2384	2288	rundll32.exe	14
PID 2288 wrote to memory of 2384	2288	rundll32.exe	14
PID 2288 wrote to memory of 2384	2288	rundll32.exe	14
PID 2288 wrote to memory of 2384	2288	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5146130e9f328c33400b2d4447ba120e.dll,#1
1⤵
PID:2384

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5146130e9f328c33400b2d4447ba120e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2384-0-0x0000000025000000-0x000000002501F000-memory.dmp

Filesize
124KB

Download