99115734cd54abadcb5b7d355e627f2b1e02ab18c8d0a70590270581d9e09e13 | Triage

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 16:15

Sharing

Report Analysis Logs

General

Target

$R0.dll
Size

94KB
MD5

77eacb0a6a9d18299fb07b7d78354bb2
SHA1

ec2599939d8c7e6fbc313ff5c42d037688d6927a
SHA256

1990244466872381b02a75749c782334fa933661fd545da5cb383ca3447023d7
SHA512

70a925395b5a20bdb7ad4d01104475e897c05d256785ff3cff62c7b94ee2bb29712b400b0158f745ae6aefc8a06025d26d6186d712702f942c427f24eae9a4aa
SSDEEP

1536:F3mnUAWBo8Ny8BFvI/mjL1nTAHW4JTjZT3tCwlWltpsWr1yjqORrSxyrTWDT23MJ:FTy8BFv9VnQTNAwlihpGKyry23M

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1768 wrote to memory of 2632	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 2632	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 2632	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 2632	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 2632	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 2632	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 2632	1768	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$R0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1768

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$R0.dll,#1
2⤵
PID:2632

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2632-0-0x0000000010000000-0x000000001004C000-memory.dmp

Filesize
304KB

Download
memory/2632-1-0x0000000010000000-0x000000001004C000-memory.dmp

Filesize
304KB

Download