64d6d9d6bb9ce147a8e024df9a5d9df80fecbfacf922a40078f07ab40cd7a5e5 | Triage

Analysis

max time kernel
0s
max time network
1s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 01:38

Sharing

Report Analysis Logs

General

Target

95e6893eaee46d576e88b0f0229d6182.dll
Size

88KB
MD5

95e6893eaee46d576e88b0f0229d6182
SHA1

2669dcb4f548290ca6b94c6c819d6bf02ac8ae92
SHA256

64d6d9d6bb9ce147a8e024df9a5d9df80fecbfacf922a40078f07ab40cd7a5e5
SHA512

6fca813363f940dd355828bcb155ebca4349e295eebe1e428f9b33c5090e32cc7378815337b0ba6b7c9e83c6645248b857e60a591ffb798378bd1162fbcc5ab2
SSDEEP

1536:xXZTsRhrXQiDkUVWCcZ0HdIc+N0qeGj4IeB:xXZIh7QiDkqyZ0uN0qeGjfY

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 2352	1820	rundll32.exe	28
PID 1820 wrote to memory of 2352	1820	rundll32.exe	28
PID 1820 wrote to memory of 2352	1820	rundll32.exe	28
PID 1820 wrote to memory of 2352	1820	rundll32.exe	28
PID 1820 wrote to memory of 2352	1820	rundll32.exe	28
PID 1820 wrote to memory of 2352	1820	rundll32.exe	28
PID 1820 wrote to memory of 2352	1820	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\95e6893eaee46d576e88b0f0229d6182.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\95e6893eaee46d576e88b0f0229d6182.dll,#1
  2⤵
  PID:2352

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2352-0-0x0000000000140000-0x000000000014D000-memory.dmp

Filesize
52KB

Download
memory/2352-1-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/2352-5-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download
memory/2352-6-0x0000000010000000-0x000000001000C000-memory.dmp

Filesize
48KB

Download