555cb2fd710da79f46f088b9fc79b541d8fec54239a71dd4e1be0c02fadd9eec | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 22:14

Sharing

Report Analysis Logs

General

Target

598b3d1844f504953666de1e2da08609.dll
Size

12KB
MD5

598b3d1844f504953666de1e2da08609
SHA1

53f8c987794a7a8d6f3c90ab5ffb26ab092e9cdd
SHA256

555cb2fd710da79f46f088b9fc79b541d8fec54239a71dd4e1be0c02fadd9eec
SHA512

e619b4645097e98936e01a8e0d3f4ea36ace7efe46ef263c18441e4cb93bdbc6f93456f57386afb7da39731697715b8a59f73699ccbd30a1c86b2963bb3ecf1e
SSDEEP

384:f+4jYlbp4jjoj4gPADuJyeDAfKcg20xse/9ZN0:fAb66LpstfKZVse/9ZS

Score

1^/10

Malware Config

Signatures

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
480	Process not Found

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 1244	816	rundll32.exe	28
PID 816 wrote to memory of 1244	816	rundll32.exe	28
PID 816 wrote to memory of 1244	816	rundll32.exe	28
PID 816 wrote to memory of 1244	816	rundll32.exe	28
PID 816 wrote to memory of 1244	816	rundll32.exe	28
PID 816 wrote to memory of 1244	816	rundll32.exe	28
PID 816 wrote to memory of 1244	816	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\598b3d1844f504953666de1e2da08609.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\598b3d1844f504953666de1e2da08609.dll,#1
  2⤵
  PID:1244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1244-0-0x0000000025000000-0x000000002501A000-memory.dmp

Filesize
104KB

Download
memory/1244-1-0x0000000025000000-0x000000002501A000-memory.dmp

Filesize
104KB

Download