209113be716dd92ebbc8da1c9aa8bb22adfda1da32e168055f3a56b1ddc0bbd5 | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
23/01/2024, 23:55

Sharing

Report Analysis Logs

General

Target

CommonSpecialist.dll
Size

145KB
MD5

b0bbe184c223bae15306fe693de38383
SHA1

e5c62ee2c6c873fc35004c51d784d252588c1a3a
SHA256

9c401dde470155b41a2f2fba0c7ebe86f3b30c88ca45390c9e87c3f21959bff2
SHA512

fac1e725f89e0f10b8003520d0d5178606c010f091d4597f79e10dee6869fcec74290db8b6aa845b4a96be4ad00a752a027f5543b3f2afdc54d2389a8ade2902
SSDEEP

3072:5nLmlmPuVTphBWCrgfz8DE39zWO1gkjCzZlgA78Nl:JamPuVTphBRrk8DE39zV2kmZl58b

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 2932	1268	rundll32.exe	28
PID 1268 wrote to memory of 2932	1268	rundll32.exe	28
PID 1268 wrote to memory of 2932	1268	rundll32.exe	28
PID 1268 wrote to memory of 2932	1268	rundll32.exe	28
PID 1268 wrote to memory of 2932	1268	rundll32.exe	28
PID 1268 wrote to memory of 2932	1268	rundll32.exe	28
PID 1268 wrote to memory of 2932	1268	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CommonSpecialist.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\CommonSpecialist.dll,#1
  2⤵
  PID:2932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads