1db426d57789f2c96c12383160804493fd844cfa6aeadde0dcd2b1ae90248dd3 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

57245bb3bd0e54e888961b5b876f16d9.dll
Size

33KB
MD5

57245bb3bd0e54e888961b5b876f16d9
SHA1

93843900bc82366a50ecd7b82f39bf4ee5925804
SHA256

1db426d57789f2c96c12383160804493fd844cfa6aeadde0dcd2b1ae90248dd3
SHA512

c555c536fee6f6fce947140ab558d326ed58047e3299d42f7b5b013a5998c20baacbb36715f98de490a9bf77fadebd0a9c1aafe18bd2b161e5c74b220da62b2e
SSDEEP

768:wEaVI5HfxVed0j1na778f02ONVO0xRAdi:wEaVo1j1o7802gvRki

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1620	1712	rundll32.exe	28
PID 1712 wrote to memory of 1620	1712	rundll32.exe	28
PID 1712 wrote to memory of 1620	1712	rundll32.exe	28
PID 1712 wrote to memory of 1620	1712	rundll32.exe	28
PID 1712 wrote to memory of 1620	1712	rundll32.exe	28
PID 1712 wrote to memory of 1620	1712	rundll32.exe	28
PID 1712 wrote to memory of 1620	1712	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\57245bb3bd0e54e888961b5b876f16d9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\57245bb3bd0e54e888961b5b876f16d9.dll,#1
  2⤵
  PID:1620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads