27c62a254020c2c11703a3be6254ebaaaed7558ba5e725d12f81b355d8cf0d35 | Triage

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/01/2024, 14:24

Sharing

Report Analysis Logs

General

Target

5b7799d061db8da88386a77ff9c00415.dll
Size

34KB
MD5

5b7799d061db8da88386a77ff9c00415
SHA1

5eacc438522d44a5d18e7f7328a4fdadde80e752
SHA256

27c62a254020c2c11703a3be6254ebaaaed7558ba5e725d12f81b355d8cf0d35
SHA512

e0ccee7262aa8173bd278ecc79558634937eb8a8ac889d37b7de3179506692d5d37e5bbb6015093843267f837a59e212229c7c1ce6fb800fee8e51d9d9764de3
SSDEEP

768:Ctz0BxMuTGblAlN475Rg/5ChwV9OR6bg4FdU:EwBhGV75RqU6rOR60

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1716	1992	rundll32.exe	28
PID 1992 wrote to memory of 1716	1992	rundll32.exe	28
PID 1992 wrote to memory of 1716	1992	rundll32.exe	28
PID 1992 wrote to memory of 1716	1992	rundll32.exe	28
PID 1992 wrote to memory of 1716	1992	rundll32.exe	28
PID 1992 wrote to memory of 1716	1992	rundll32.exe	28
PID 1992 wrote to memory of 1716	1992	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b7799d061db8da88386a77ff9c00415.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b7799d061db8da88386a77ff9c00415.dll,#1
  2⤵
  PID:1716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads