879d19a5181d81a1747ea49b42d4c24549fa59c9932b9ac18dbf67eba6815810 | Triage

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 19:14

Sharing

Report Analysis Logs

General

Target

754be748c97ab6e5731c0dc7b7a584da.dll
Size

402KB
MD5

754be748c97ab6e5731c0dc7b7a584da
SHA1

c8d3a8fb39e16d268c157a75c270b400cc149922
SHA256

879d19a5181d81a1747ea49b42d4c24549fa59c9932b9ac18dbf67eba6815810
SHA512

607d0e568f910166027d9a61b5e6ec5d711aa442147f52372a89c1bbe9de1641c50fa08a5800bbdd5faf5a8876575b610518e4870ca5ad7a58eb0b169cd3be28
SSDEEP

12288:NYV+inLjCMuAZaqwQuB5+xr1hyC3vZUwOge+k:IfL7uAZdwer1YChUbn+k

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 1972	2160	rundll32.exe	28
PID 2160 wrote to memory of 1972	2160	rundll32.exe	28
PID 2160 wrote to memory of 1972	2160	rundll32.exe	28
PID 2160 wrote to memory of 1972	2160	rundll32.exe	28
PID 2160 wrote to memory of 1972	2160	rundll32.exe	28
PID 2160 wrote to memory of 1972	2160	rundll32.exe	28
PID 2160 wrote to memory of 1972	2160	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\754be748c97ab6e5731c0dc7b7a584da.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\754be748c97ab6e5731c0dc7b7a584da.dll,#1
  2⤵
  PID:1972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads