7a9f5e568abb53c579fc17ce44738b50a406fccad4e52696483f71264d01c49f | Triage

Analysis

max time kernel
91s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27-01-2024 12:59

Sharing

Report Analysis Logs

General

Target

7a5118e866d36b6ae857338b1558e4bf.dll
Size

32KB
MD5

7a5118e866d36b6ae857338b1558e4bf
SHA1

05484ba35bed660d81de2633fdab0c9a74e7ccf3
SHA256

7a9f5e568abb53c579fc17ce44738b50a406fccad4e52696483f71264d01c49f
SHA512

ee5f2f60c2b213d15d5df5bd11f946236da8678be17f81500f235cb8988bf17fc2746328760d44202873c4edc9a59425876230f6a3464d321b242130c92b1bc1
SSDEEP

384:BuVehkGw8LseSkxIpe0MKcAB8OU1rQ7B8MvCW:lhkGw84/40MNOU1WZC

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 804 wrote to memory of 4600	804	rundll32.exe	55
PID 804 wrote to memory of 4600	804	rundll32.exe	55
PID 804 wrote to memory of 4600	804	rundll32.exe	55

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a5118e866d36b6ae857338b1558e4bf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:804
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a5118e866d36b6ae857338b1558e4bf.dll,#1
  2⤵
  PID:4600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads