a974ed473fd6e8ed868dc4e1599f26c211daa1908cc67a446308da314d8f4feb | Triage

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/02/2024, 21:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

97aaad182af6b1bcb3071abaaff36457.dll
Size

13KB
MD5

97aaad182af6b1bcb3071abaaff36457
SHA1

54ce97cb8a0a963359f471483c2589f1c4ba406f
SHA256

a974ed473fd6e8ed868dc4e1599f26c211daa1908cc67a446308da314d8f4feb
SHA512

0811af35a5ec8d6a2fa735722fc7065f0ecff4765d11af4b870aa2a44b1cd5a488e786561f2b1951d749fbf83d506296dd6db4c4006ff4c97a95322ccf76e256
SSDEEP

384:NKHrSXpYbhQa5cyoaFFVuqbbJ+ujzlm+M7iS:kHrSXz6caFjvXYEXA

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 1700	3048	rundll32.exe	28
PID 3048 wrote to memory of 1700	3048	rundll32.exe	28
PID 3048 wrote to memory of 1700	3048	rundll32.exe	28
PID 3048 wrote to memory of 1700	3048	rundll32.exe	28
PID 3048 wrote to memory of 1700	3048	rundll32.exe	28
PID 3048 wrote to memory of 1700	3048	rundll32.exe	28
PID 3048 wrote to memory of 1700	3048	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\97aaad182af6b1bcb3071abaaff36457.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\97aaad182af6b1bcb3071abaaff36457.dll,#1
  2⤵
  PID:1700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads