e355e4d9fbfc4d275b988903ca4f3866693ebd75f7c2abfee539f0a03b0a3a43 | Triage

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-01-2024 21:54

Sharing

Report Analysis Logs

General

Target

72f2372e63c0e6b9f86c169b24e7dfe4.dll
Size

29KB
MD5

72f2372e63c0e6b9f86c169b24e7dfe4
SHA1

d8f6e5c226709d55638319f91ccf94879aabe2a6
SHA256

e355e4d9fbfc4d275b988903ca4f3866693ebd75f7c2abfee539f0a03b0a3a43
SHA512

08fdc0da34c0ee92dcc99f885906036830444ee1e2a75acebf7d87932f58e3d37bb48882422f8707b68c6492779119ef7e050ee2dea21b3130ab68836b05119c
SSDEEP

768:1aH4jqKKIO/I7CEews63LeQ4Gfler1PUd/RAaB:1EK9O/I5ei3qtGfoBUd

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2532	2928	rundll32.exe	28
PID 2928 wrote to memory of 2532	2928	rundll32.exe	28
PID 2928 wrote to memory of 2532	2928	rundll32.exe	28
PID 2928 wrote to memory of 2532	2928	rundll32.exe	28
PID 2928 wrote to memory of 2532	2928	rundll32.exe	28
PID 2928 wrote to memory of 2532	2928	rundll32.exe	28
PID 2928 wrote to memory of 2532	2928	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\72f2372e63c0e6b9f86c169b24e7dfe4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\72f2372e63c0e6b9f86c169b24e7dfe4.dll,#1
  2⤵
  PID:2532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2532-0-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/2532-1-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/2532-2-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/2532-3-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download