4e39cec3cae46e68b08dd620b703d5fc9038b9bb4b72b63e240ba90a97ce4ab8 | Triage

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 21:38

Sharing

Report Analysis Logs

General

Target

a2cde4b5208fa43994522cc74e777d71.dll
Size

48KB
MD5

a2cde4b5208fa43994522cc74e777d71
SHA1

3149928fea5b50a265f5ac57409b2ca809d3757f
SHA256

4e39cec3cae46e68b08dd620b703d5fc9038b9bb4b72b63e240ba90a97ce4ab8
SHA512

6bdad9846365447e7be8d0b1239f0c9df58b012ec08c276d7df63fbeffb91e94c477af5629a5fa471409163cc8925ee269664fb7e091478a076bbee839cd6e2c
SSDEEP

768:Ah5S4S2g8eNKmbkMbwkSGHy7XdkTmZfDquTb:AbbS1NKUkMbwXGuyTyDqu

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2076	rundll32.exe
2076	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 2076	2696	rundll32.exe	28
PID 2696 wrote to memory of 2076	2696	rundll32.exe	28
PID 2696 wrote to memory of 2076	2696	rundll32.exe	28
PID 2696 wrote to memory of 2076	2696	rundll32.exe	28
PID 2696 wrote to memory of 2076	2696	rundll32.exe	28
PID 2696 wrote to memory of 2076	2696	rundll32.exe	28
PID 2696 wrote to memory of 2076	2696	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a2cde4b5208fa43994522cc74e777d71.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a2cde4b5208fa43994522cc74e777d71.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads