c81a1ca3b9dfc192d5b6336f032a64769c0925f902aa40f9aa03e8ccfc4e3eca | Triage

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 11:28

Sharing

Report Analysis Logs

General

Target

65429d951f51faedb2433afb93f7fc8b.dll
Size

32KB
MD5

65429d951f51faedb2433afb93f7fc8b
SHA1

7f4a86c544afe1b64d9ba4da7b8992e56decbf37
SHA256

c81a1ca3b9dfc192d5b6336f032a64769c0925f902aa40f9aa03e8ccfc4e3eca
SHA512

1ca8910028d73370312bf5d15d970af84e6ffb081fe0da77c5c5f6452eff2972a5efda72331725f1cd1c8e63bdd80605bed9f19351da15d14d2710c0b2a5c2b3
SSDEEP

768:qZ2I7fc/zqbCP7yvVeiEZlhCDilRbBWbte:q0Iw/zqA7QVeiEr8OlRbBWbte

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 2840	1220	rundll32.exe	28
PID 1220 wrote to memory of 2840	1220	rundll32.exe	28
PID 1220 wrote to memory of 2840	1220	rundll32.exe	28
PID 1220 wrote to memory of 2840	1220	rundll32.exe	28
PID 1220 wrote to memory of 2840	1220	rundll32.exe	28
PID 1220 wrote to memory of 2840	1220	rundll32.exe	28
PID 1220 wrote to memory of 2840	1220	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\65429d951f51faedb2433afb93f7fc8b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\65429d951f51faedb2433afb93f7fc8b.dll,#1
  2⤵
  PID:2840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads