2335bc20f9515a2f2d152face2e7d86a9dc271d1cf995199625e4e776103dcf1 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/02/2024, 04:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8894131a24716266a826c3193fbc5ec7.dll
Size

67KB
MD5

8894131a24716266a826c3193fbc5ec7
SHA1

9ecce16f5db833272433f9d5a1b638846be02c4f
SHA256

2335bc20f9515a2f2d152face2e7d86a9dc271d1cf995199625e4e776103dcf1
SHA512

189d9de6cd5ed07414371c303adde4b381b1365e11e41947e287301e4f84eda874c8dfb9b0bff9f4f7c83c5b85d4e652bbada86edd1006ba495716176680eef4
SSDEEP

1536:ob8Vwn/9zRGVOWK/k2A3WtMZ7fxb4IK6ir3kOQK:oz/3iCFMZKCEU0

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2496	2440	rundll32.exe	16
PID 2440 wrote to memory of 2496	2440	rundll32.exe	16
PID 2440 wrote to memory of 2496	2440	rundll32.exe	16
PID 2440 wrote to memory of 2496	2440	rundll32.exe	16
PID 2440 wrote to memory of 2496	2440	rundll32.exe	16
PID 2440 wrote to memory of 2496	2440	rundll32.exe	16
PID 2440 wrote to memory of 2496	2440	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8894131a24716266a826c3193fbc5ec7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8894131a24716266a826c3193fbc5ec7.dll,#1
  2⤵
  PID:2496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2496-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2496-1-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download