7319d9ffc783536ab5cf1c1f5231790d83b85a218e91dded954f5fca06b2e151 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 19:01

Sharing

Report Analysis Logs

General

Target

5741491934e2aa31a02d5ea64e13ba58.dll
Size

49KB
MD5

5741491934e2aa31a02d5ea64e13ba58
SHA1

9eb127677784352879bcf5fcf6094bbf177a437e
SHA256

7319d9ffc783536ab5cf1c1f5231790d83b85a218e91dded954f5fca06b2e151
SHA512

b233d75b9f8e77677b2bbf2912fc51bd4f4e633438f78ae2b090807031bf84b4a705b296cca64c656a8a072515e6e93eccf8d050c799a4104e69ac23825800e0
SSDEEP

1536:zmFqAF1sa6KczkDVP2Dfsw6Y1sBj7hX8:z01N6KVO4qsBj7hX8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 3012	2652	rundll32.exe	28
PID 2652 wrote to memory of 3012	2652	rundll32.exe	28
PID 2652 wrote to memory of 3012	2652	rundll32.exe	28
PID 2652 wrote to memory of 3012	2652	rundll32.exe	28
PID 2652 wrote to memory of 3012	2652	rundll32.exe	28
PID 2652 wrote to memory of 3012	2652	rundll32.exe	28
PID 2652 wrote to memory of 3012	2652	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5741491934e2aa31a02d5ea64e13ba58.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5741491934e2aa31a02d5ea64e13ba58.dll,#1
  2⤵
  PID:3012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3012-0-0x00000000001B0000-0x00000000001C1000-memory.dmp

Filesize
68KB

Download