887c411c9f2d4aeb2e6248fd33c0f8737c94cca669b3e1fb7ed2baeaeb07ea58 | Triage

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 06:29

Sharing

Report Analysis Logs

General

Target

55ba468821c51846cd7f7128410e5d42.dll
Size

5KB
MD5

55ba468821c51846cd7f7128410e5d42
SHA1

f70ae9609e95821a697a320adbdb2bb91bd63ee9
SHA256

887c411c9f2d4aeb2e6248fd33c0f8737c94cca669b3e1fb7ed2baeaeb07ea58
SHA512

81812c19a3f7461968f8ac12d3cc5fb0137ff0bfc450234f2fa0e44454611685a5536d9bc2b7ebe08084d166c9c09f77db2dc7fbeba6ac954e5e9aea1738f793
SSDEEP

96:Z1jZk1VcHK9Cc5Unb3tolhjnlcxLWgwv:m1Vcq9Cc583ClhJ8I

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2032	2556	rundll32.exe	14
PID 2556 wrote to memory of 2032	2556	rundll32.exe	14
PID 2556 wrote to memory of 2032	2556	rundll32.exe	14
PID 2556 wrote to memory of 2032	2556	rundll32.exe	14
PID 2556 wrote to memory of 2032	2556	rundll32.exe	14
PID 2556 wrote to memory of 2032	2556	rundll32.exe	14
PID 2556 wrote to memory of 2032	2556	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\55ba468821c51846cd7f7128410e5d42.dll,#1
1⤵
PID:2032

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\55ba468821c51846cd7f7128410e5d42.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2032-2-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2032-1-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2032-0-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download