a1e574b9f40550f87e8ab2febc3ef737bdb91c7242bc55442cb36cbc8066f6e2 | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-01-2024 07:53

Sharing

Report Analysis Logs

General

Target

7f4bb1f2f2ee749a0922e40bbed4396e.dll
Size

73KB
MD5

7f4bb1f2f2ee749a0922e40bbed4396e
SHA1

453e70f88289c5f05df96a2a406f0d1d761722ee
SHA256

a1e574b9f40550f87e8ab2febc3ef737bdb91c7242bc55442cb36cbc8066f6e2
SHA512

5c98176e2ab1e3d992a2ba66988359665c7ab95f50d65fb6c4340ad7c65c59dd86169506b46fc3eaf62ee6870290c50c141f65e29e902fe7072097690d07b21d
SSDEEP

1536:g+iyEA9Dze61uA+307mNYRHkgU2ezB8oo0:g+a8mAuX3dNBggioo0

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 3048	2380	rundll32.exe	28
PID 2380 wrote to memory of 3048	2380	rundll32.exe	28
PID 2380 wrote to memory of 3048	2380	rundll32.exe	28
PID 2380 wrote to memory of 3048	2380	rundll32.exe	28
PID 2380 wrote to memory of 3048	2380	rundll32.exe	28
PID 2380 wrote to memory of 3048	2380	rundll32.exe	28
PID 2380 wrote to memory of 3048	2380	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f4bb1f2f2ee749a0922e40bbed4396e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f4bb1f2f2ee749a0922e40bbed4396e.dll,#1
  2⤵
  PID:3048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3048-0-0x0000000040960000-0x0000000040971000-memory.dmp

Filesize
68KB

Download