8fb3dc9dbc95b7854eb91fa165d7fd36361df9f62bbdf1715b6f606b8f48c14e | Triage

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 17:57

Sharing

Report Analysis Logs

General

Target

7526b01861f357360f6891b6a7ec1b5c.dll
Size

73KB
MD5

7526b01861f357360f6891b6a7ec1b5c
SHA1

9d5ca04413be1ff0b5b88a23a6a6ef93e8abd69e
SHA256

8fb3dc9dbc95b7854eb91fa165d7fd36361df9f62bbdf1715b6f606b8f48c14e
SHA512

51de67378f2ce5fe0ab0ae9cdbbaa00723aa9dd078b601af1293a6c9c5b21b55b0a76f622efee9ad1909798d03b9116eb4e8e38273649262d31f559a7dca30cf
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2760	2092	rundll32.exe	28
PID 2092 wrote to memory of 2760	2092	rundll32.exe	28
PID 2092 wrote to memory of 2760	2092	rundll32.exe	28
PID 2092 wrote to memory of 2760	2092	rundll32.exe	28
PID 2092 wrote to memory of 2760	2092	rundll32.exe	28
PID 2092 wrote to memory of 2760	2092	rundll32.exe	28
PID 2092 wrote to memory of 2760	2092	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7526b01861f357360f6891b6a7ec1b5c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7526b01861f357360f6891b6a7ec1b5c.dll,#1
  2⤵
  PID:2760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads