32f3b0a9b147408db3a930ea3f86e16e249eb7bd2034b23bdf01b996c24fc86b | Triage

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 00:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

980224eede7017ba0e9813c622b6a000.dll
Size

125KB
MD5

980224eede7017ba0e9813c622b6a000
SHA1

04c9ae599e0db8c659904525bd88e341ef783384
SHA256

32f3b0a9b147408db3a930ea3f86e16e249eb7bd2034b23bdf01b996c24fc86b
SHA512

0f9fd4a9ce986415a47d04c0243daafbd1542aaf88b7ce94a9e4b279b5d089ff3b14d63e171d2e729d92c7ce0a62f11c64c3fe254c42b88631dbd988e271f949
SSDEEP

3072:h1YlDIWwgnemJfJZ4rkIWma07roXKfHo:vYlDWE5f3Z

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2360	3028	rundll32.exe	28
PID 3028 wrote to memory of 2360	3028	rundll32.exe	28
PID 3028 wrote to memory of 2360	3028	rundll32.exe	28
PID 3028 wrote to memory of 2360	3028	rundll32.exe	28
PID 3028 wrote to memory of 2360	3028	rundll32.exe	28
PID 3028 wrote to memory of 2360	3028	rundll32.exe	28
PID 3028 wrote to memory of 2360	3028	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\980224eede7017ba0e9813c622b6a000.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\980224eede7017ba0e9813c622b6a000.dll,#1
  2⤵
  PID:2360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2360-0-0x0000000010000000-0x0000000010049000-memory.dmp

Filesize
292KB

Download
memory/2360-1-0x0000000010000000-0x0000000010049000-memory.dmp

Filesize
292KB

Download