b86fe282bc5699fa400d8eee7ce18ed42068799457c568d23f2d0b0b19dccb9b | Triage

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/01/2024, 18:17

Sharing

Report Analysis Logs

General

Target

5b857caf1fe458e36c541457df2a9ec5.dll
Size

2.0MB
MD5

5b857caf1fe458e36c541457df2a9ec5
SHA1

fc1ba6cacc55d2344f83cf536feaf5fc8c5b255b
SHA256

b86fe282bc5699fa400d8eee7ce18ed42068799457c568d23f2d0b0b19dccb9b
SHA512

0350ff3db147f2450c985c062e786fdc9998fda48b3e2ed0ce98b2fe05373d30b266f2804735fadcd7debc23ea06f34d0e79369f0e4fb20edcf109712a491a3a
SSDEEP

49152:mB1ayn94SdsUJ1gr/AbUmke3PK4lx9ePJ2i9:mB1fs81k/A4oTl+B2i9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 1568	2164	rundll32.exe	28
PID 2164 wrote to memory of 1568	2164	rundll32.exe	28
PID 2164 wrote to memory of 1568	2164	rundll32.exe	28
PID 2164 wrote to memory of 1568	2164	rundll32.exe	28
PID 2164 wrote to memory of 1568	2164	rundll32.exe	28
PID 2164 wrote to memory of 1568	2164	rundll32.exe	28
PID 2164 wrote to memory of 1568	2164	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b857caf1fe458e36c541457df2a9ec5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b857caf1fe458e36c541457df2a9ec5.dll,#1
  2⤵
  PID:1568

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1568-0-0x0000000001F20000-0x00000000027E9000-memory.dmp

Filesize
8.8MB

Download
memory/1568-1-0x0000000001F20000-0x00000000027E9000-memory.dmp

Filesize
8.8MB

Download