3fb9571cd857392a9a59270c5eb80762ec41ad27cf9031d2481536016bc69ba5 | Triage

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 21:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8d5eeb7aab9abde469921e22f28db633.dll
Size

32KB
MD5

8d5eeb7aab9abde469921e22f28db633
SHA1

c839ae48e294e34943d65b4bc9d5ff4299e054e2
SHA256

3fb9571cd857392a9a59270c5eb80762ec41ad27cf9031d2481536016bc69ba5
SHA512

9bb117eeca2c123eeee2a3a64159eec27084d001501aa563009403190b323d64d0b6657302bd621f1b76d167f425443f50e3c3a9606b653634bc78ba25d9de21
SSDEEP

768:LVU9QGriJHNAcNdWzUZ9kNpNxBWNGNsg85y:LVoQaiTAyVYNCg

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 840	1540	rundll32.exe	28
PID 1540 wrote to memory of 840	1540	rundll32.exe	28
PID 1540 wrote to memory of 840	1540	rundll32.exe	28
PID 1540 wrote to memory of 840	1540	rundll32.exe	28
PID 1540 wrote to memory of 840	1540	rundll32.exe	28
PID 1540 wrote to memory of 840	1540	rundll32.exe	28
PID 1540 wrote to memory of 840	1540	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8d5eeb7aab9abde469921e22f28db633.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8d5eeb7aab9abde469921e22f28db633.dll,#1
  2⤵
  PID:840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads