638b0e2ffbfeabfd48e26c8db43e9b7eb1c65cf02a39608f6132f80b12388abd | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/01/2024, 15:34

Sharing

Report Analysis Logs

General

Target

80346d2b59f81f05f11dfcb6caeb5723.dll
Size

72KB
MD5

80346d2b59f81f05f11dfcb6caeb5723
SHA1

67ec411b452f4877140e39d8e4d4d303c8416354
SHA256

638b0e2ffbfeabfd48e26c8db43e9b7eb1c65cf02a39608f6132f80b12388abd
SHA512

9c1713eedcf45702e6e4b08c061029ffb2470a3739f9a406b0915e7c16a400731650a266c47ef30cee67131d11e1c1adbaf11c9d8f9671e4e088a2351bc8c7c5
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2456	2536	rundll32.exe	28
PID 2536 wrote to memory of 2456	2536	rundll32.exe	28
PID 2536 wrote to memory of 2456	2536	rundll32.exe	28
PID 2536 wrote to memory of 2456	2536	rundll32.exe	28
PID 2536 wrote to memory of 2456	2536	rundll32.exe	28
PID 2536 wrote to memory of 2456	2536	rundll32.exe	28
PID 2536 wrote to memory of 2456	2536	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\80346d2b59f81f05f11dfcb6caeb5723.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\80346d2b59f81f05f11dfcb6caeb5723.dll,#1
  2⤵
  PID:2456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads