4acd027e21969450c8809b921e44161ee27e4c59a3d027e4a098db3ca12c124e | Triage

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 00:48

Sharing

Report Analysis Logs

General

Target

9a5a419571b2ccc0ca587d926426bd88.dll
Size

68KB
MD5

9a5a419571b2ccc0ca587d926426bd88
SHA1

cb466578bb7679e01838ee66d80e7193207e6061
SHA256

4acd027e21969450c8809b921e44161ee27e4c59a3d027e4a098db3ca12c124e
SHA512

a4c1674a121de2505c571d2ebfb0c7faff821261b9081153ab8a5e585798e99aa3c8344cb2ed4e4e546772cf92aa13a99b77925f2a43960fa0d0db10e489b9a8
SSDEEP

1536:Bm1NGJVGYCGri2IpguUoK0EeNiSNfKXG8IjF88:kX0VBCFpgJ1NeNZf2a88

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 1400	1876	rundll32.exe	28
PID 1876 wrote to memory of 1400	1876	rundll32.exe	28
PID 1876 wrote to memory of 1400	1876	rundll32.exe	28
PID 1876 wrote to memory of 1400	1876	rundll32.exe	28
PID 1876 wrote to memory of 1400	1876	rundll32.exe	28
PID 1876 wrote to memory of 1400	1876	rundll32.exe	28
PID 1876 wrote to memory of 1400	1876	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a5a419571b2ccc0ca587d926426bd88.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a5a419571b2ccc0ca587d926426bd88.dll,#1
  2⤵
  PID:1400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads