3e4c0d38b5e8673c740917bc444ea154bbcfd99e2c424f3e1a8760a00ddc1589 | Triage

Analysis

max time kernel
4s
max time network
58s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/01/2024, 18:56

Sharing

Report Analysis Logs

General

Target

SDL.dll
Size

1.7MB
MD5

6f430604ac9fc394f246fd977cd14453
SHA1

a6897132a3287e91944153a7d6e3d665c88dfb5b
SHA256

f3484711f1e557cfbfa918692783e1b28a19672c8b007d3cc923d3c874967a2a
SHA512

4032e8ee893c10ebcb6fb3622d75aeb6967438361565f7d73fcc7dfe9fc303a1263e75a82a25cc03f2b7c67b54805b2a5bcd68783bfb0a187b816e6eee09721c
SSDEEP

24576:GD5SnmCF9rAasVuu0mQLoXaQUjXirsXRXbjrW+5saw1RP:GQnR9rA6LaVUGrQRLjrW+5saw11

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 2780	2804	rundll32.exe	30
PID 2804 wrote to memory of 2780	2804	rundll32.exe	30
PID 2804 wrote to memory of 2780	2804	rundll32.exe	30
PID 2804 wrote to memory of 2780	2804	rundll32.exe	30
PID 2804 wrote to memory of 2780	2804	rundll32.exe	30
PID 2804 wrote to memory of 2780	2804	rundll32.exe	30
PID 2804 wrote to memory of 2780	2804	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SDL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SDL.dll,#1
  2⤵
  PID:2780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads