ae4c39d8793d3fe3ad88a8fa2be81d5973c42a4e1fbcb96b881f5a9e0dc15d44 | Triage

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 08:26

Sharing

Report Analysis Logs

General

Target

5306c45838bdaa5d596f01d05b13e123.dll
Size

2KB
MD5

5306c45838bdaa5d596f01d05b13e123
SHA1

45cf10457da90c07d68b5e96b2ba477d0dc75df2
SHA256

ae4c39d8793d3fe3ad88a8fa2be81d5973c42a4e1fbcb96b881f5a9e0dc15d44
SHA512

28d18fa2ff4a555bf6fb4d7d86b150b3d881399f0d201b7aef51ebe5c6a3cdfcb803cda72690233edee3dbf16cf085aab1404b4b2f6c97a64c5ff6806f2a11db

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2216	1736	rundll32.exe	28
PID 1736 wrote to memory of 2216	1736	rundll32.exe	28
PID 1736 wrote to memory of 2216	1736	rundll32.exe	28
PID 1736 wrote to memory of 2216	1736	rundll32.exe	28
PID 1736 wrote to memory of 2216	1736	rundll32.exe	28
PID 1736 wrote to memory of 2216	1736	rundll32.exe	28
PID 1736 wrote to memory of 2216	1736	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5306c45838bdaa5d596f01d05b13e123.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5306c45838bdaa5d596f01d05b13e123.dll,#1
  2⤵
  PID:2216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2216-0-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download