7d1bb3f620d658c57579f72efc8253331fda4c44019c85c8cb64fd9785d17493 | Triage

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 19:21

Sharing

Report Analysis Logs

General

Target

754eb543e77ea24efa18e835ad4bac0b.dll
Size

72KB
MD5

754eb543e77ea24efa18e835ad4bac0b
SHA1

2ff35eed3dd5a1aa27f0b160766312df1d06d03e
SHA256

7d1bb3f620d658c57579f72efc8253331fda4c44019c85c8cb64fd9785d17493
SHA512

5381847070274513730d1e81f088f06b12da3385b8ccd7849fcb65cc01086e51a3b2ac3b5bf7f7371b3f08b0a3c3cf631bf1a58583bdb4c625195110931fd860
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2056	2480	rundll32.exe	28
PID 2480 wrote to memory of 2056	2480	rundll32.exe	28
PID 2480 wrote to memory of 2056	2480	rundll32.exe	28
PID 2480 wrote to memory of 2056	2480	rundll32.exe	28
PID 2480 wrote to memory of 2056	2480	rundll32.exe	28
PID 2480 wrote to memory of 2056	2480	rundll32.exe	28
PID 2480 wrote to memory of 2056	2480	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\754eb543e77ea24efa18e835ad4bac0b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\754eb543e77ea24efa18e835ad4bac0b.dll,#1
  2⤵
  PID:2056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads