d1db7a7228a4d0a095ea0ee16c5a5f527ebebf4a9210f7b89a33ff1c73bcc49d | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 03:16

Sharing

Report Analysis Logs

General

Target

555675b8218bbcecf2eb28cc9b09f459.dll
Size

72KB
MD5

555675b8218bbcecf2eb28cc9b09f459
SHA1

98f353ae2766e1941d8ad0b9f30a46be3698d4a9
SHA256

d1db7a7228a4d0a095ea0ee16c5a5f527ebebf4a9210f7b89a33ff1c73bcc49d
SHA512

5a27e762cc62d9c0b6784d370c3efddfef8d9ad3bfd41d1282ee5cc4caa5fa5298a862be79b92e7ac30163a14faf8e0b70f043037891ac1b07ff5dbc92b791a5
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuP:C5UOq0ukgOK2l7aFQP

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2876	2208	rundll32.exe	28
PID 2208 wrote to memory of 2876	2208	rundll32.exe	28
PID 2208 wrote to memory of 2876	2208	rundll32.exe	28
PID 2208 wrote to memory of 2876	2208	rundll32.exe	28
PID 2208 wrote to memory of 2876	2208	rundll32.exe	28
PID 2208 wrote to memory of 2876	2208	rundll32.exe	28
PID 2208 wrote to memory of 2876	2208	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\555675b8218bbcecf2eb28cc9b09f459.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\555675b8218bbcecf2eb28cc9b09f459.dll,#1
  2⤵
  PID:2876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads