180d540e443db7ee00ce564bbaec82148a1aecbff68fc617c156cc33a6d43563 | Triage

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 08:36

Sharing

Report Analysis Logs

General

Target

8eb34c609408c1c46bf3bfbb4f053871.dll
Size

35KB
MD5

8eb34c609408c1c46bf3bfbb4f053871
SHA1

e56f61957b45eaf2cccd47ad872de39b45479d3d
SHA256

180d540e443db7ee00ce564bbaec82148a1aecbff68fc617c156cc33a6d43563
SHA512

6f1df254825cb12ca0d82c7433d3ac19e0c82de4d99a85de7dc07a691dacf29a2828e13316c6f64834bf5929dea27fc951fefe45c117fba605160ecda26963a6
SSDEEP

768:4CWxsWcuueWF3hx2j/6VoXaryuTrhFSIPWV:4CxoO3ri6VV2ChFSI+V

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 3012	1352	rundll32.exe	28
PID 1352 wrote to memory of 3012	1352	rundll32.exe	28
PID 1352 wrote to memory of 3012	1352	rundll32.exe	28
PID 1352 wrote to memory of 3012	1352	rundll32.exe	28
PID 1352 wrote to memory of 3012	1352	rundll32.exe	28
PID 1352 wrote to memory of 3012	1352	rundll32.exe	28
PID 1352 wrote to memory of 3012	1352	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8eb34c609408c1c46bf3bfbb4f053871.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8eb34c609408c1c46bf3bfbb4f053871.dll,#1
  2⤵
  PID:3012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads