ae360e5cd00d9e9232bfdd4fec94ef843223827924b7fad5c596504ca05a9fda | Triage

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28-01-2024 13:14

Sharing

Report Analysis Logs

General

Target

7d3b4e28f9b946ed7cea1b65d29c91dd.dll
Size

216KB
MD5

7d3b4e28f9b946ed7cea1b65d29c91dd
SHA1

e3d8307b68c17c5b557c0c34442e9e309c601a74
SHA256

ae360e5cd00d9e9232bfdd4fec94ef843223827924b7fad5c596504ca05a9fda
SHA512

b1b877bf112f64687bfbf9b6da90e14a549eeff2153ce00fd0274a16520785695f1c8d25ff550de14b8c1860a675d800d02c44dfa631d75f6f79d4307ba310ec
SSDEEP

6144:IZH1z+JCYnxnImO5t3BBXReC3FG01mTBfVyYjt:CYnxn8L3Fz1mTxU6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 1848	1680	rundll32.exe	12
PID 1680 wrote to memory of 1848	1680	rundll32.exe	12
PID 1680 wrote to memory of 1848	1680	rundll32.exe	12
PID 1680 wrote to memory of 1848	1680	rundll32.exe	12
PID 1680 wrote to memory of 1848	1680	rundll32.exe	12
PID 1680 wrote to memory of 1848	1680	rundll32.exe	12
PID 1680 wrote to memory of 1848	1680	rundll32.exe	12

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7d3b4e28f9b946ed7cea1b65d29c91dd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7d3b4e28f9b946ed7cea1b65d29c91dd.dll,#1
  2⤵
  PID:1848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads