e81f82a484a040c3ee70d7f02b4ff2e59acd077b08489bafe67b2bea4efae4f5 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/01/2024, 11:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7facd17ea2c75225f7df58005e000f43.dll
Size

40KB
MD5

7facd17ea2c75225f7df58005e000f43
SHA1

b781b6ed7e04d4477ffd0a1ad1adc4463552f803
SHA256

e81f82a484a040c3ee70d7f02b4ff2e59acd077b08489bafe67b2bea4efae4f5
SHA512

ca8623486912ce0295b7fea913d7c3874580c123dea0bdd0e1e067f641a3dac4e9703bf4f312f034c21887ccedcf630f6dacfbb11a3af782c01635445be24cf1
SSDEEP

384:7sGg9iitpxt4VuYyjBrrGky+lsPxvJWvj/TQJ8V:fAF40Yyj4v+lovJSj/TQJ4

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2348	2376	rundll32.exe	28
PID 2376 wrote to memory of 2348	2376	rundll32.exe	28
PID 2376 wrote to memory of 2348	2376	rundll32.exe	28
PID 2376 wrote to memory of 2348	2376	rundll32.exe	28
PID 2376 wrote to memory of 2348	2376	rundll32.exe	28
PID 2376 wrote to memory of 2348	2376	rundll32.exe	28
PID 2376 wrote to memory of 2348	2376	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7facd17ea2c75225f7df58005e000f43.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7facd17ea2c75225f7df58005e000f43.dll,#1
  2⤵
  PID:2348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads