a5e872f07c71b7d1ae8fdbe535f1d15c340dc286d106520444e2326bbc6bfa58 | Triage

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 17:26

Sharing

Report Analysis Logs

General

Target

5949baceded3a1a9d72d2e4791ba8b1e.dll
Size

35KB
MD5

5949baceded3a1a9d72d2e4791ba8b1e
SHA1

e872c094ba7afb3eff142f4d250700ca95d1bf85
SHA256

a5e872f07c71b7d1ae8fdbe535f1d15c340dc286d106520444e2326bbc6bfa58
SHA512

ba884052f437204b34705ed9b0f0a4451d1cdc96c8fbf3e2477f052167d072a582af3fefdcb633b8c0df15f859681a589b4c5ef4573e0bc105543861b6cae0d9
SSDEEP

768:pHeHq51szazGUQY7abCJO/4gFb76a4zXKA7q6oC1uaRvoO:QHq51sAiLJioCkavt

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2188	1712	rundll32.exe	28
PID 1712 wrote to memory of 2188	1712	rundll32.exe	28
PID 1712 wrote to memory of 2188	1712	rundll32.exe	28
PID 1712 wrote to memory of 2188	1712	rundll32.exe	28
PID 1712 wrote to memory of 2188	1712	rundll32.exe	28
PID 1712 wrote to memory of 2188	1712	rundll32.exe	28
PID 1712 wrote to memory of 2188	1712	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5949baceded3a1a9d72d2e4791ba8b1e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5949baceded3a1a9d72d2e4791ba8b1e.dll,#1
  2⤵
  PID:2188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2188-0-0x0000000000180000-0x0000000000192000-memory.dmp

Filesize
72KB

Download