6f78f51990788ec9b8efa276741dac09d51bd39fb88110e7ae28e5bbb6e60b6c | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-01-2024 13:07

Sharing

Report Analysis Logs

General

Target

776f55e45ce8f4e00d7a0de257c082c9.dll
Size

135KB
MD5

776f55e45ce8f4e00d7a0de257c082c9
SHA1

cea541e10f451387ed60769f72b8723a6fa191af
SHA256

6f78f51990788ec9b8efa276741dac09d51bd39fb88110e7ae28e5bbb6e60b6c
SHA512

74e9d77f979c419f636aebcb4cc090e15fb473b4cc0a7d39d3ee0d248205b6a2197408d89948768ecddbb525dc161346216f8e24bda08063ec09a01c4878bbde
SSDEEP

3072:5G9koQUBr1XAi0Gv7YHZE76VuLFUSfSEp:8Qsr1Qi5YHaVLa7

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 1372	2372	rundll32.exe	28
PID 2372 wrote to memory of 1372	2372	rundll32.exe	28
PID 2372 wrote to memory of 1372	2372	rundll32.exe	28
PID 2372 wrote to memory of 1372	2372	rundll32.exe	28
PID 2372 wrote to memory of 1372	2372	rundll32.exe	28
PID 2372 wrote to memory of 1372	2372	rundll32.exe	28
PID 2372 wrote to memory of 1372	2372	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\776f55e45ce8f4e00d7a0de257c082c9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\776f55e45ce8f4e00d7a0de257c082c9.dll,#1
  2⤵
  PID:1372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1372-0-0x0000000040960000-0x0000000040971000-memory.dmp

Filesize
68KB

Download