1487f1c4f94b83803b907024a99ea290dd30a9b597624266560345bf9fab41a9 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-01-2024 08:49

Sharing

Report Analysis Logs

General

Target

7f68cf670142f14c30060df6c88433bd.dll
Size

52KB
MD5

7f68cf670142f14c30060df6c88433bd
SHA1

99e1eff5904512119fc64ef9b6fff55c6bad65c2
SHA256

1487f1c4f94b83803b907024a99ea290dd30a9b597624266560345bf9fab41a9
SHA512

743b9eac1313a8408914a8989b49daf53585bccbd8f5a34da053f72806334fd7f17c4bcdf1ccd5c980d8c1750619222a2f15242c2bfbbe554dd3ba5fccff281d
SSDEEP

768:ZgC8+skET1ZjgDOmR4MaC1ZxUZT6KnoCCEh8gwz:z6kET1Bg/aCPuNoCr8n

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1708	rundll32.exe
1708	rundll32.exe
1708	rundll32.exe
1708	rundll32.exe
1708	rundll32.exe
1708	rundll32.exe
1708	rundll32.exe
1708	rundll32.exe
1708	rundll32.exe
1708	rundll32.exe
1708	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 1708	1984	rundll32.exe	28
PID 1984 wrote to memory of 1708	1984	rundll32.exe	28
PID 1984 wrote to memory of 1708	1984	rundll32.exe	28
PID 1984 wrote to memory of 1708	1984	rundll32.exe	28
PID 1984 wrote to memory of 1708	1984	rundll32.exe	28
PID 1984 wrote to memory of 1708	1984	rundll32.exe	28
PID 1984 wrote to memory of 1708	1984	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f68cf670142f14c30060df6c88433bd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f68cf670142f14c30060df6c88433bd.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1708-0-0x0000000000110000-0x000000000011E000-memory.dmp

Filesize
56KB

Download