73a62f5aa8b6ff36cea814de5603199998b12a7662a03959d852b628b9cfa144 | Triage

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9ac0f1916ea0d3fbd38c0088075e3584.dll
Size

55KB
MD5

9ac0f1916ea0d3fbd38c0088075e3584
SHA1

bed417f8a9ca0453d1478ee94b44218f58c44e27
SHA256

73a62f5aa8b6ff36cea814de5603199998b12a7662a03959d852b628b9cfa144
SHA512

22167e85995a57a6fefcbe78fc7f1ee3b33081b5eff9faa927c5efdacf843071459033d128e70490e35be4723f4f097c4719fa91f9c910e4a5761d13218df268
SSDEEP

1536:yHZAMFlepuKvAdZ0p5CnYtuDcOTsdPyhz:yHqqYp+dZYQYqR4dPyhz

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 1660	1964	rundll32.exe	28
PID 1964 wrote to memory of 1660	1964	rundll32.exe	28
PID 1964 wrote to memory of 1660	1964	rundll32.exe	28
PID 1964 wrote to memory of 1660	1964	rundll32.exe	28
PID 1964 wrote to memory of 1660	1964	rundll32.exe	28
PID 1964 wrote to memory of 1660	1964	rundll32.exe	28
PID 1964 wrote to memory of 1660	1964	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ac0f1916ea0d3fbd38c0088075e3584.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9ac0f1916ea0d3fbd38c0088075e3584.dll,#1
  2⤵
  PID:1660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads