23f91c4ee38c3b324b8f9ad2a9302458474e4287d349891f91354044e7a33229 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 02:53

Sharing

Report Analysis Logs

General

Target

738bf1aeeff284d65cd79094a2f61cd4.dll
Size

34KB
MD5

738bf1aeeff284d65cd79094a2f61cd4
SHA1

a1e68733f98fa80dfb901be5fa1a3ac5a700953c
SHA256

23f91c4ee38c3b324b8f9ad2a9302458474e4287d349891f91354044e7a33229
SHA512

4635b730bac739efdeea1fcb688e783b3d2587ff866d9713ceda9f2b2f1860a94c98482fbbd08b230696a68fd7d1c21abe47d9b27d17449baa2895fb69bcc2d5
SSDEEP

768:xJOcSsphT92HPYXzNj75ZMfC5Chw09FRst5:xJOHeT8Hm75ZM6U6yFRc5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 1420	2380	rundll32.exe	11
PID 2380 wrote to memory of 1420	2380	rundll32.exe	11
PID 2380 wrote to memory of 1420	2380	rundll32.exe	11
PID 2380 wrote to memory of 1420	2380	rundll32.exe	11
PID 2380 wrote to memory of 1420	2380	rundll32.exe	11
PID 2380 wrote to memory of 1420	2380	rundll32.exe	11
PID 2380 wrote to memory of 1420	2380	rundll32.exe	11

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\738bf1aeeff284d65cd79094a2f61cd4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\738bf1aeeff284d65cd79094a2f61cd4.dll,#1
  2⤵
  PID:1420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads