06da1fcccf3d6cbd6ba0e69b84bd5cc612d301dc2f007d28b321e9838256a1fc | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04-02-2024 06:30

Sharing

Report Analysis Logs

General

Target

8e74c0f72dc9a1f6d9aae8ddc8332c01.dll
Size

50KB
MD5

8e74c0f72dc9a1f6d9aae8ddc8332c01
SHA1

6da7022ed8074c32534b0fa981d96b3a8641b611
SHA256

06da1fcccf3d6cbd6ba0e69b84bd5cc612d301dc2f007d28b321e9838256a1fc
SHA512

9e88057159c14251d338d579c929c46a92797761ded529e3b888608c47eadaa125db1edc5246dd100a5173628114fd4f4e256e7639d560017852c07a78db9834
SSDEEP

1536:Yb60MNuRKVQEXvswEjgdiLMA+MzrM/qOdbT7aRG4V:Y+0wuRMQe0yhcAVH4

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 2864	2816	rundll32.exe	28
PID 2816 wrote to memory of 2864	2816	rundll32.exe	28
PID 2816 wrote to memory of 2864	2816	rundll32.exe	28
PID 2816 wrote to memory of 2864	2816	rundll32.exe	28
PID 2816 wrote to memory of 2864	2816	rundll32.exe	28
PID 2816 wrote to memory of 2864	2816	rundll32.exe	28
PID 2816 wrote to memory of 2864	2816	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8e74c0f72dc9a1f6d9aae8ddc8332c01.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8e74c0f72dc9a1f6d9aae8ddc8332c01.dll,#1
  2⤵
  PID:2864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2864-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2864-1-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download