81b709b7cf2379333d21cf9b24da8f989b43148838175e7fa5d987493cb92d0d | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 06:51

Sharing

Report Analysis Logs

General

Target

9689d69e87390da0a233566b6672af57.dll
Size

83KB
MD5

9689d69e87390da0a233566b6672af57
SHA1

1e15622976866a98a2ab0d1bb7efd5df558ac589
SHA256

81b709b7cf2379333d21cf9b24da8f989b43148838175e7fa5d987493cb92d0d
SHA512

9784c6517e33066fdea946493f72db06d4e7f4dba70e55cfa8db82ddaebfdd9b5bccb286f6cabdd6ccc7888dac59de4a5ce161b6762281582b393fbde7ed4b30
SSDEEP

1536:FMKegfzkQLCles6IRPOZR1RnK8AHDGRF33rU+I:FMNQulrr2BxK8AHKRFHI+I

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2764	2080	rundll32.exe	28
PID 2080 wrote to memory of 2764	2080	rundll32.exe	28
PID 2080 wrote to memory of 2764	2080	rundll32.exe	28
PID 2080 wrote to memory of 2764	2080	rundll32.exe	28
PID 2080 wrote to memory of 2764	2080	rundll32.exe	28
PID 2080 wrote to memory of 2764	2080	rundll32.exe	28
PID 2080 wrote to memory of 2764	2080	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9689d69e87390da0a233566b6672af57.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9689d69e87390da0a233566b6672af57.dll,#1
  2⤵
  PID:2764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2764-0-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/2764-2-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/2764-1-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download