e4be9f7301cc717b7ab937e749f456854bc085bd0a39c11daf086057f8c6c4f1 | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/01/2024, 03:35

Sharing

Report Analysis Logs

General

Target

5a2b2bebb9a3e547d1d66c3078006e3d.dll
Size

16KB
MD5

5a2b2bebb9a3e547d1d66c3078006e3d
SHA1

ba9f4fa75b20c4d75afcb7f4ce63942b5d326ae0
SHA256

e4be9f7301cc717b7ab937e749f456854bc085bd0a39c11daf086057f8c6c4f1
SHA512

c4e6081ea669af59d690ce7ade338ac75d4bc90085fe96b719ff7b27dee3971cdf3eb5395c73523fba0e95923b0dcade5c2b292dde2eb0b85d408645fc6168c1
SSDEEP

384:l3Cdk4FhNQsnZaQg6f+x65nFSmJryFEjdIQbS:xCdk46Gm65nFS0diQbS

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2124	2416	rundll32.exe	28
PID 2416 wrote to memory of 2124	2416	rundll32.exe	28
PID 2416 wrote to memory of 2124	2416	rundll32.exe	28
PID 2416 wrote to memory of 2124	2416	rundll32.exe	28
PID 2416 wrote to memory of 2124	2416	rundll32.exe	28
PID 2416 wrote to memory of 2124	2416	rundll32.exe	28
PID 2416 wrote to memory of 2124	2416	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a2b2bebb9a3e547d1d66c3078006e3d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a2b2bebb9a3e547d1d66c3078006e3d.dll,#1
  2⤵
  PID:2124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads