1289e00152ee4449fc166026d2f7a67478dff933561e0a39c88ac401763c7e65 | Triage

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-01-2024 01:02

Sharing

Report Analysis Logs

General

Target

Accessibility.dll
Size

10KB
MD5

1b4cc6782e295675217cd17df70057f3
SHA1

f468087e7fbaa5aeed1fc41062b198570ae017e3
SHA256

f08bdbf797dfdbbde37000fb29141caec4beb4dc0f552ab2cfe0887e1e6c5f60
SHA512

05289e9514d173694a1e15dc5228976c963572353c78412bc79bdc933ae89df08e889736232c6240e4fa1e8f26689cb4eeae4a83aa9e333a6d1882b8b857a8fb
SSDEEP

192:qN1WRFlDWlolDWlIJh2ICtMBYY5IQY2xLnG63etbTWm/W:+1UlqlolqlIWGPISLGptXWm/W

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2204	2504	rundll32.exe	16
PID 2504 wrote to memory of 2204	2504	rundll32.exe	16
PID 2504 wrote to memory of 2204	2504	rundll32.exe	16
PID 2504 wrote to memory of 2204	2504	rundll32.exe	16
PID 2504 wrote to memory of 2204	2504	rundll32.exe	16
PID 2504 wrote to memory of 2204	2504	rundll32.exe	16
PID 2504 wrote to memory of 2204	2504	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Accessibility.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Accessibility.dll,#1
  2⤵
  PID:2204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads