f24aa7386e2a8fc5ddadad9cf129bb62215eeb911f71f3110e98eba4beab08b2 | Triage

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/01/2024, 10:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

771936906a87621f6ef6cf5d9c79dce8.dll
Size

131KB
MD5

771936906a87621f6ef6cf5d9c79dce8
SHA1

43f540522ae55d32882ab784e914c248af320d6a
SHA256

f24aa7386e2a8fc5ddadad9cf129bb62215eeb911f71f3110e98eba4beab08b2
SHA512

fa109c53e5d3dbd4f5447b34e395ed020ebb8b20c0c3061a5fb6d377348dac2d67fe69d5291d488b8ef39c20bd037da86752d2a8c400d4a387f22a2cf1b34a5a
SSDEEP

3072:248u3PBvRifhSQA/xCdK567EJSCxMelWSdJ09d/:2NkPKfKz5E7Cx1lFq/

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2964	2252	rundll32.exe	28
PID 2252 wrote to memory of 2964	2252	rundll32.exe	28
PID 2252 wrote to memory of 2964	2252	rundll32.exe	28
PID 2252 wrote to memory of 2964	2252	rundll32.exe	28
PID 2252 wrote to memory of 2964	2252	rundll32.exe	28
PID 2252 wrote to memory of 2964	2252	rundll32.exe	28
PID 2252 wrote to memory of 2964	2252	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\771936906a87621f6ef6cf5d9c79dce8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\771936906a87621f6ef6cf5d9c79dce8.dll,#1
  2⤵
  PID:2964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads