dd45619bbe7fc8a44fc4c7cd560fe5d472803ecf3ea0f7ab407c35ea8f0eef40 | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 00:28

Sharing

Report Analysis Logs

General

Target

95c54da4db15f727a89d90ecfd892723.dll
Size

136KB
MD5

95c54da4db15f727a89d90ecfd892723
SHA1

c691cac0c97b129f0441d5d9433b639ee2432df2
SHA256

dd45619bbe7fc8a44fc4c7cd560fe5d472803ecf3ea0f7ab407c35ea8f0eef40
SHA512

01dadec015540a2efedbffb2fe2f432a8ab90134c5cb4df5f8e99c5531a4b4aa6ce3a0ee03cb226431fd8f5f01d1e0d64da59fcb62b09b676588335f783bfe26
SSDEEP

3072:j9e8vJBYLLcvHiTUlUOmR5pC/3r8yJonyk:jM4m3UH2vE8/

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 3028	2940	rundll32.exe	28
PID 2940 wrote to memory of 3028	2940	rundll32.exe	28
PID 2940 wrote to memory of 3028	2940	rundll32.exe	28
PID 2940 wrote to memory of 3028	2940	rundll32.exe	28
PID 2940 wrote to memory of 3028	2940	rundll32.exe	28
PID 2940 wrote to memory of 3028	2940	rundll32.exe	28
PID 2940 wrote to memory of 3028	2940	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\95c54da4db15f727a89d90ecfd892723.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\95c54da4db15f727a89d90ecfd892723.dll,#1
  2⤵
  PID:3028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads