ffaa6ae5e499945093a6fe2a7a05504f8796127cd6f4de239b47a7e86715214c | Triage

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13-02-2024 06:06

Sharing

Report Analysis Logs

General

Target

samp.dll
Size

1.1MB
MD5

5ba5f0be7af99dfd03fb39e88a970a2b
SHA1

cfee81e92701580ff63e62dbb38d4035a05cfbab
SHA256

b72b5dbe725f81864ca3f78bc7063bda56cc05fc7188af822fa7a754432553a2
SHA512

a7459e33509f33eb21268d4bd70604953cb5b71555ef217286f848794e71980e0b5541c87d1d935d999fddd79e83e99893d97e9a90b8b570c5daa8fde34288a2
SSDEEP

24576:hZgAAx6bqT+6QbhmCkh+LPQ5M+5BxX1s/elplhAEZOQ+uMPGP:JjuaP9PQ5MarKWJhsz6P

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2512 wrote to memory of 2136	2512	rundll32.exe	rundll32.exe
PID 2512 wrote to memory of 2136	2512	rundll32.exe	rundll32.exe
PID 2512 wrote to memory of 2136	2512	rundll32.exe	rundll32.exe
PID 2512 wrote to memory of 2136	2512	rundll32.exe	rundll32.exe
PID 2512 wrote to memory of 2136	2512	rundll32.exe	rundll32.exe
PID 2512 wrote to memory of 2136	2512	rundll32.exe	rundll32.exe
PID 2512 wrote to memory of 2136	2512	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\samp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2512

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\samp.dll,#1
2⤵
PID:2136

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...