487af268383d10e3a82c28f107b32e8dca9e920af481ae3a593f331b8f05b96b | Triage

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/01/2024, 19:10

Sharing

Report Analysis Logs

General

Target

7828b653505cac716ba6f536a2a1d403.dll
Size

12KB
MD5

7828b653505cac716ba6f536a2a1d403
SHA1

479e17a254b0469afb052f6bf1e7d4275188c5b0
SHA256

487af268383d10e3a82c28f107b32e8dca9e920af481ae3a593f331b8f05b96b
SHA512

d59e96e12a15ccccb5c728d419551e00c8faf0e3aa3e6b371cedf1824dd35fbfe0ac5b1d0289ef1cfa2c007a04f85a5655a21c52c989df1fbb3e8447aba8673b
SSDEEP

192:XEPpqaExFg9RQ/g2QqlC20qwgVuUbY4Wl:XMZErbHdz0GVJb/Wl

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2840	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 2840	2632	rundll32.exe	28
PID 2632 wrote to memory of 2840	2632	rundll32.exe	28
PID 2632 wrote to memory of 2840	2632	rundll32.exe	28
PID 2632 wrote to memory of 2840	2632	rundll32.exe	28
PID 2632 wrote to memory of 2840	2632	rundll32.exe	28
PID 2632 wrote to memory of 2840	2632	rundll32.exe	28
PID 2632 wrote to memory of 2840	2632	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7828b653505cac716ba6f536a2a1d403.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7828b653505cac716ba6f536a2a1d403.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads