ddc4a23befb3e27cfd656a9bd382e3784b9f0ca9dd02a916a6e07760388bca9c | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 07:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

741370ea028884c01a80d9a87b39aa50.dll
Size

72KB
MD5

741370ea028884c01a80d9a87b39aa50
SHA1

d9704306dab5274370d8415024e867c0c3de39c2
SHA256

ddc4a23befb3e27cfd656a9bd382e3784b9f0ca9dd02a916a6e07760388bca9c
SHA512

5007367bfd56e5fe5dfba6f7658ec6dcdc0dc52e23a52aac82a3677f50c0d95cd26172256e1a3680ff338bfa90f0e6c50645fd9026b6ce0b17ee9a4b151a4670
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2164	3064	rundll32.exe	10
PID 3064 wrote to memory of 2164	3064	rundll32.exe	10
PID 3064 wrote to memory of 2164	3064	rundll32.exe	10
PID 3064 wrote to memory of 2164	3064	rundll32.exe	10
PID 3064 wrote to memory of 2164	3064	rundll32.exe	10
PID 3064 wrote to memory of 2164	3064	rundll32.exe	10
PID 3064 wrote to memory of 2164	3064	rundll32.exe	10

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\741370ea028884c01a80d9a87b39aa50.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\741370ea028884c01a80d9a87b39aa50.dll,#1
  2⤵
  PID:2164

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads