4aa77f9087fdd1e0e6c14368e5dba63b4604729d62c66a659a6e090e85b5da74 | Triage

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 04:54

Sharing

Report Analysis Logs

General

Target

9acddb4a53dcd5269679933cc3427cda.dll
Size

17KB
MD5

9acddb4a53dcd5269679933cc3427cda
SHA1

62eb059ee4ec02bd74f2add9d8d214c3a51c861d
SHA256

4aa77f9087fdd1e0e6c14368e5dba63b4604729d62c66a659a6e090e85b5da74
SHA512

298bbddc220358c1137af5b0fdd37165b513e021ce05db9c8b852019280ebd6b26fee3dae60b85459c5cfd7de64eeab2bdfa296e343be9fce2c9c6b493beae9f
SSDEEP

384:AJUo/w/F0YzWsrWzM8PkTGKX8WIbxzMQsi34:wU3/WYSs8WGKs5RMQsi34

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2988	2976	rundll32.exe	28
PID 2976 wrote to memory of 2988	2976	rundll32.exe	28
PID 2976 wrote to memory of 2988	2976	rundll32.exe	28
PID 2976 wrote to memory of 2988	2976	rundll32.exe	28
PID 2976 wrote to memory of 2988	2976	rundll32.exe	28
PID 2976 wrote to memory of 2988	2976	rundll32.exe	28
PID 2976 wrote to memory of 2988	2976	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9acddb4a53dcd5269679933cc3427cda.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9acddb4a53dcd5269679933cc3427cda.dll,#1
  2⤵
  PID:2988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2988-0-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download
memory/2988-1-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download