206cf5716979adf1932b86b7c96d3026afab577df98e50427665b8d15e81f392 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19-01-2024 01:55

Sharing

Report Analysis Logs

General

Target

6697702bdf8509ece5bccdcb20b85f6e.dll
Size

34KB
MD5

6697702bdf8509ece5bccdcb20b85f6e
SHA1

7456fae4e1c42bc153c8c328051e4474b128466a
SHA256

206cf5716979adf1932b86b7c96d3026afab577df98e50427665b8d15e81f392
SHA512

3c8b911fe5f2830f369a43b247c751ca43ce5170c305c589e154ee3a56a6bd57e2d533e0c46571d61225dee0c8a88c2a0263e8161f58195aa8e11e880717594b
SSDEEP

768:WbOhTLYMpXQ3T3YNrZr//7WvkZCOqhnPmRZnX:+OhTPN/Nr17WvHpORZX

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2032	2252	rundll32.exe	15
PID 2252 wrote to memory of 2032	2252	rundll32.exe	15
PID 2252 wrote to memory of 2032	2252	rundll32.exe	15
PID 2252 wrote to memory of 2032	2252	rundll32.exe	15
PID 2252 wrote to memory of 2032	2252	rundll32.exe	15
PID 2252 wrote to memory of 2032	2252	rundll32.exe	15
PID 2252 wrote to memory of 2032	2252	rundll32.exe	15

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6697702bdf8509ece5bccdcb20b85f6e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6697702bdf8509ece5bccdcb20b85f6e.dll,#1
  2⤵
  PID:2032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads