Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25-01-2024 15:58
Static task
static1
Behavioral task
behavioral1
Sample
155c56ab59d1d04617058ec1e60df08a53193c9d1cb4b01be031bb93f12be2e7.dll
Resource
win7-20231129-en
windows7-x64
1 signatures
150 seconds
General
-
Target
155c56ab59d1d04617058ec1e60df08a53193c9d1cb4b01be031bb93f12be2e7.dll
-
Size
5.5MB
-
MD5
95b3f93daa6353f164446fe6e93c998d
-
SHA1
ad1c77f48f721cc84e11f222af51a14a9caf4058
-
SHA256
155c56ab59d1d04617058ec1e60df08a53193c9d1cb4b01be031bb93f12be2e7
-
SHA512
3f7bee83993763c30f2f1a51f3210f90a77e413de0699fa83e9a7f4f3ab82d925381507c66b023a93e34295f7cf0a6241c48f0fa4f84c550d332e7a927e3c2a6
-
SSDEEP
98304:A8UnXrt3bc0O68nEtN7uS36KrxSHvZLNrlhFkH3M09ejSUBqicDNyv4qEcbcPXN:A7bVY0H1NNFeJkXN9vUwr+4Tk2N
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 2356 wrote to memory of 2008 2356 rundll32.exe rundll32.exe PID 2356 wrote to memory of 2008 2356 rundll32.exe rundll32.exe PID 2356 wrote to memory of 2008 2356 rundll32.exe rundll32.exe PID 2356 wrote to memory of 2008 2356 rundll32.exe rundll32.exe PID 2356 wrote to memory of 2008 2356 rundll32.exe rundll32.exe PID 2356 wrote to memory of 2008 2356 rundll32.exe rundll32.exe PID 2356 wrote to memory of 2008 2356 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\155c56ab59d1d04617058ec1e60df08a53193c9d1cb4b01be031bb93f12be2e7.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\155c56ab59d1d04617058ec1e60df08a53193c9d1cb4b01be031bb93f12be2e7.dll,#12⤵PID:2008
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2008-0-0x0000000074B70000-0x00000000752FE000-memory.dmpFilesize
7.6MB
-
memory/2008-1-0x0000000073A80000-0x000000007420E000-memory.dmpFilesize
7.6MB
-
memory/2008-2-0x0000000074B70000-0x00000000752FE000-memory.dmpFilesize
7.6MB
-
memory/2008-3-0x0000000073A80000-0x000000007420E000-memory.dmpFilesize
7.6MB