33ca3eeb77e0aeee99441648a53efda51df23c4c304d715c6c31671f96514217 | Triage

Analysis

max time kernel
0s
max time network
3s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 00:31

Sharing

Report Analysis Logs

General

Target

9a51f86ac5ff5ae8dae88b19414b37fa.dll
Size

57KB
MD5

9a51f86ac5ff5ae8dae88b19414b37fa
SHA1

c9f25435722b45bae9532ee1fdd90de41bfe7faf
SHA256

33ca3eeb77e0aeee99441648a53efda51df23c4c304d715c6c31671f96514217
SHA512

c3240c230d0017188a134246100bf19027475d7b3226475e43732467fa1a677af13bb81fadb1f9185d06868486ef03b7606f2bbb4e99779f90510e94aa26a3a0
SSDEEP

1536:+fQAl+7ovOyMetkp9KAE68UvcwPmO07bPDG7:aQAl+pMtME6Bv5epy7

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2256	2228	rundll32.exe	28
PID 2228 wrote to memory of 2256	2228	rundll32.exe	28
PID 2228 wrote to memory of 2256	2228	rundll32.exe	28
PID 2228 wrote to memory of 2256	2228	rundll32.exe	28
PID 2228 wrote to memory of 2256	2228	rundll32.exe	28
PID 2228 wrote to memory of 2256	2228	rundll32.exe	28
PID 2228 wrote to memory of 2256	2228	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a51f86ac5ff5ae8dae88b19414b37fa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a51f86ac5ff5ae8dae88b19414b37fa.dll,#1
  2⤵
  PID:2256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2256-0-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download
memory/2256-1-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download
memory/2256-2-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download