694d262d2fb5e8566764bc7cd5ed15cd56be8591cac1634139758dd712a60d58 | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10-01-2024 18:43

Sharing

Report Analysis Logs

General

Target

51513aad3dd3a3cf5794983a4266f896.dll
Size

31KB
MD5

51513aad3dd3a3cf5794983a4266f896
SHA1

548a264ad6038553427ee5967075f29ede74815a
SHA256

694d262d2fb5e8566764bc7cd5ed15cd56be8591cac1634139758dd712a60d58
SHA512

9b2bf303ee872162dad1e28dfd53425e39772e36641892b2013682e8be0e2089f254ff061ca6d0535dd740ee1f5c6e0a1bc52b592b182cac093782b5733a8919
SSDEEP

768:Eufkh+tB7dNyJwD/zqNL5N07Cek4bgF4m4n9iX:Eufk2fNba3euim09

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2128	3048	rundll32.exe	28
PID 3048 wrote to memory of 2128	3048	rundll32.exe	28
PID 3048 wrote to memory of 2128	3048	rundll32.exe	28
PID 3048 wrote to memory of 2128	3048	rundll32.exe	28
PID 3048 wrote to memory of 2128	3048	rundll32.exe	28
PID 3048 wrote to memory of 2128	3048	rundll32.exe	28
PID 3048 wrote to memory of 2128	3048	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\51513aad3dd3a3cf5794983a4266f896.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\51513aad3dd3a3cf5794983a4266f896.dll,#1
  2⤵
  PID:2128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads