fed3ef647ef6c00079fec1f911876a234245b606ec1d879a9728bd81c0c7bb62 | Triage

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19-01-2024 17:06

Sharing

Report Analysis Logs

General

Target

682c31393ac71834dab576eff952564c.dll
Size

72KB
MD5

682c31393ac71834dab576eff952564c
SHA1

6616d7d6404c30f0638688ad251aa28da29ac33a
SHA256

fed3ef647ef6c00079fec1f911876a234245b606ec1d879a9728bd81c0c7bb62
SHA512

925e99e388f0351ccb646f5629ebec1f402cb4bb259a09f9c34434dbfd54962aa7af5df41bb68e06ac2808de6d797bdb76744db7ed31b633609067402830beeb
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 1208	2024	rundll32.exe	28
PID 2024 wrote to memory of 1208	2024	rundll32.exe	28
PID 2024 wrote to memory of 1208	2024	rundll32.exe	28
PID 2024 wrote to memory of 1208	2024	rundll32.exe	28
PID 2024 wrote to memory of 1208	2024	rundll32.exe	28
PID 2024 wrote to memory of 1208	2024	rundll32.exe	28
PID 2024 wrote to memory of 1208	2024	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\682c31393ac71834dab576eff952564c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\682c31393ac71834dab576eff952564c.dll,#1
  2⤵
  PID:1208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads