fa986f9828e0e1ab0659854a78e68653b5dd762ab38c3b4e6add735312b23df6 | Triage

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 21:17

Sharing

Report Analysis Logs

General

Target

97a037528fabd4a515d7d594570bc02b.dll
Size

302KB
MD5

97a037528fabd4a515d7d594570bc02b
SHA1

f7da626c38949d77bc11351410a5d9ca82c51dac
SHA256

fa986f9828e0e1ab0659854a78e68653b5dd762ab38c3b4e6add735312b23df6
SHA512

eaf7952535da1ac88ce369d2d19ad07f7b6398dbac4a2aef8d9eb79bbf438d6afd1f2f7b3e5b0c6be825baf53927d669bd4d5f906e47bb1988a6dbf691fa8bd3
SSDEEP

6144:l4yRZVLlfh7rZthO+JjkuHEEAt/wz/60ZEPC:+QZdfrXg+JwuKt/S/60Zq

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2832	2168	rundll32.exe	28
PID 2168 wrote to memory of 2832	2168	rundll32.exe	28
PID 2168 wrote to memory of 2832	2168	rundll32.exe	28
PID 2168 wrote to memory of 2832	2168	rundll32.exe	28
PID 2168 wrote to memory of 2832	2168	rundll32.exe	28
PID 2168 wrote to memory of 2832	2168	rundll32.exe	28
PID 2168 wrote to memory of 2832	2168	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\97a037528fabd4a515d7d594570bc02b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\97a037528fabd4a515d7d594570bc02b.dll,#1
  2⤵
  PID:2832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads