1487f1c4f94b83803b907024a99ea290dd30a9b597624266560345bf9fab41a9 | Triage

Analysis

max time kernel
134s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2024 08:49

Sharing

Report Analysis Logs

General

Target

7f68cf670142f14c30060df6c88433bd.dll
Size

52KB
MD5

7f68cf670142f14c30060df6c88433bd
SHA1

99e1eff5904512119fc64ef9b6fff55c6bad65c2
SHA256

1487f1c4f94b83803b907024a99ea290dd30a9b597624266560345bf9fab41a9
SHA512

743b9eac1313a8408914a8989b49daf53585bccbd8f5a34da053f72806334fd7f17c4bcdf1ccd5c980d8c1750619222a2f15242c2bfbbe554dd3ba5fccff281d
SSDEEP

768:ZgC8+skET1ZjgDOmR4MaC1ZxUZT6KnoCCEh8gwz:z6kET1Bg/aCPuNoCr8n

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1072	rundll32.exe
1072	rundll32.exe
1072	rundll32.exe
1072	rundll32.exe
1072	rundll32.exe
1072	rundll32.exe
1072	rundll32.exe
1072	rundll32.exe
1072	rundll32.exe
1072	rundll32.exe
1072	rundll32.exe
1072	rundll32.exe
1072	rundll32.exe
1072	rundll32.exe
1072	rundll32.exe
1072	rundll32.exe
1072	rundll32.exe
1072	rundll32.exe
1072	rundll32.exe
1072	rundll32.exe
1072	rundll32.exe
1072	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4080 wrote to memory of 1072	4080	rundll32.exe	13
PID 4080 wrote to memory of 1072	4080	rundll32.exe	13
PID 4080 wrote to memory of 1072	4080	rundll32.exe	13

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f68cf670142f14c30060df6c88433bd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7f68cf670142f14c30060df6c88433bd.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads