cc61aafdcec149005f0c3fa9936ba8d57f12fe484993e5f41e8e9230456bbc4b | Triage

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 09:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9b5883179ecd3cf1bdff50d2168c3e35.dll
Size

34KB
MD5

9b5883179ecd3cf1bdff50d2168c3e35
SHA1

8144abb4728d5e73aaef8c9f20f0a974022e1ff1
SHA256

cc61aafdcec149005f0c3fa9936ba8d57f12fe484993e5f41e8e9230456bbc4b
SHA512

7091803cd04d44babc568ef1c2eb34230a9166761d9266d60056bc7084b684234df80dd1964694fe5e48c830f114d62cd8c8e718faab43c18c83e6fa61ffb470
SSDEEP

768:XbOhTLYMpXQ3T3YNrZr//7WvkZCOqhnPmRZnX:rOhTPN/Nr17WvHpORZX

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2528	1728	rundll32.exe	28
PID 1728 wrote to memory of 2528	1728	rundll32.exe	28
PID 1728 wrote to memory of 2528	1728	rundll32.exe	28
PID 1728 wrote to memory of 2528	1728	rundll32.exe	28
PID 1728 wrote to memory of 2528	1728	rundll32.exe	28
PID 1728 wrote to memory of 2528	1728	rundll32.exe	28
PID 1728 wrote to memory of 2528	1728	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9b5883179ecd3cf1bdff50d2168c3e35.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9b5883179ecd3cf1bdff50d2168c3e35.dll,#1
  2⤵
  PID:2528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads