bd56944306a6423aec9927cb4c8e038c2d830c9f3eda561885564a2ed2af7c53 | Triage

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 09:16

Sharing

Report Analysis Logs

General

Target

531e5b7eedc8376ab165c377fcb2cf76.dll
Size

72KB
MD5

531e5b7eedc8376ab165c377fcb2cf76
SHA1

3ecc2472ebe4c37dab7b13555f9a0533daa77271
SHA256

bd56944306a6423aec9927cb4c8e038c2d830c9f3eda561885564a2ed2af7c53
SHA512

2ca21a4c2f7a0b1ae04fb74b11ec6d8944f193f0a4f0cde0ad70b433940752d08c9cbe479049472a0149bd792a63046d5e4a1952c034530e078c978cd9b5c356
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 1536	2384	rundll32.exe	16
PID 2384 wrote to memory of 1536	2384	rundll32.exe	16
PID 2384 wrote to memory of 1536	2384	rundll32.exe	16
PID 2384 wrote to memory of 1536	2384	rundll32.exe	16
PID 2384 wrote to memory of 1536	2384	rundll32.exe	16
PID 2384 wrote to memory of 1536	2384	rundll32.exe	16
PID 2384 wrote to memory of 1536	2384	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\531e5b7eedc8376ab165c377fcb2cf76.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\531e5b7eedc8376ab165c377fcb2cf76.dll,#1
  2⤵
  PID:1536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads