8fc6add96f8874a78b332688f055f44e5ef2b8d753de81bd767505810099ee64 | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18-01-2024 18:20

Sharing

Report Analysis Logs

General

Target

65b5d9f8320ad7fb0c396d4567ebb765.dll
Size

50KB
MD5

65b5d9f8320ad7fb0c396d4567ebb765
SHA1

de5d510838f1655b15459e0bdf9a35a9b68533de
SHA256

8fc6add96f8874a78b332688f055f44e5ef2b8d753de81bd767505810099ee64
SHA512

03a913342239a436212e62ac35a1542a5f129a5627c176659cc2241a84351d95e610f07ea902414b4da9fe873ee60b0378823d3e7e0155ad89fbb919d267db6f
SSDEEP

1536:Fg84Es7igOTorMd8lHnEmfntE9WBcOokrqfMIaIPCA:m8xoigeQLaLRsFFIPt

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2832	2432	rundll32.exe	28
PID 2432 wrote to memory of 2832	2432	rundll32.exe	28
PID 2432 wrote to memory of 2832	2432	rundll32.exe	28
PID 2432 wrote to memory of 2832	2432	rundll32.exe	28
PID 2432 wrote to memory of 2832	2432	rundll32.exe	28
PID 2432 wrote to memory of 2832	2432	rundll32.exe	28
PID 2432 wrote to memory of 2832	2432	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\65b5d9f8320ad7fb0c396d4567ebb765.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\65b5d9f8320ad7fb0c396d4567ebb765.dll,#1
  2⤵
  PID:2832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2832-0-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download
memory/2832-1-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download
memory/2832-2-0x0000000000160000-0x0000000000165000-memory.dmp

Filesize
20KB

Download