5e27b63538336a5f1faf77b6e82da9e24986f370d8553ea3029babc9103a58ae | Triage

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 23:11

Sharing

Report Analysis Logs

General

Target

8d9b3e160760507cc4be5b0ace64768f.dll
Size

36KB
MD5

8d9b3e160760507cc4be5b0ace64768f
SHA1

7916d2a88d3b6f1c57fa0db34a7b9acb2191d52b
SHA256

5e27b63538336a5f1faf77b6e82da9e24986f370d8553ea3029babc9103a58ae
SHA512

0e267ca32f784c5c2d5973731d5b9fd67627343f5f0897d0435e5d9b7cc3a88511c9d176cc9b0543a2bc9dd99fae3f78dc2d386b89cc5e819dda30cf3c69fdb9
SSDEEP

768:K8YMGsvrY400sHRBqg2PO59lpkjHR+itlyE6du/JN:M/svrWTHRkg4sKlyEHN

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 2064	1520	rundll32.exe	28
PID 1520 wrote to memory of 2064	1520	rundll32.exe	28
PID 1520 wrote to memory of 2064	1520	rundll32.exe	28
PID 1520 wrote to memory of 2064	1520	rundll32.exe	28
PID 1520 wrote to memory of 2064	1520	rundll32.exe	28
PID 1520 wrote to memory of 2064	1520	rundll32.exe	28
PID 1520 wrote to memory of 2064	1520	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8d9b3e160760507cc4be5b0ace64768f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8d9b3e160760507cc4be5b0ace64768f.dll,#1
  2⤵
  PID:2064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2064-0-0x00000000000A0000-0x00000000000AD000-memory.dmp

Filesize
52KB

Download
memory/2064-1-0x00000000000A0000-0x00000000000AD000-memory.dmp

Filesize
52KB

Download
memory/2064-2-0x00000000000A0000-0x00000000000AD000-memory.dmp

Filesize
52KB

Download
memory/2064-3-0x00000000000B0000-0x00000000000BD000-memory.dmp

Filesize
52KB

Download