a20cbb1a026880ca7316a8dff70aa823eecb550b1a3f94108b879dd0b09ec1fb | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 11:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a1b42ea0153da3cabf497270c3c9f22c.dll
Size

14KB
MD5

a1b42ea0153da3cabf497270c3c9f22c
SHA1

5865bb47ee1dcbc311fdad84b6c00c94fecb1476
SHA256

a20cbb1a026880ca7316a8dff70aa823eecb550b1a3f94108b879dd0b09ec1fb
SHA512

69342f69bd4a1f9e3d3db8fe6e0d74250466ed38e63686b836ff7a2f7b57157435f7252b9eb75b226a596505d188cf6cb66b28299e07886a3a6bf05d933bab2d
SSDEEP

384:CBFYFEFPJ3V8NRzfWt3cZ9kLBvH9mA2jh:CbJ3GTWt3ccNcrj

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 1128	2884	rundll32.exe	28
PID 2884 wrote to memory of 1128	2884	rundll32.exe	28
PID 2884 wrote to memory of 1128	2884	rundll32.exe	28
PID 2884 wrote to memory of 1128	2884	rundll32.exe	28
PID 2884 wrote to memory of 1128	2884	rundll32.exe	28
PID 2884 wrote to memory of 1128	2884	rundll32.exe	28
PID 2884 wrote to memory of 1128	2884	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1b42ea0153da3cabf497270c3c9f22c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1b42ea0153da3cabf497270c3c9f22c.dll,#1
  2⤵
  PID:1128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1128-0-0x0000000010000000-0x0000000010006000-memory.dmp

Filesize
24KB

Download
memory/1128-1-0x0000000010000000-0x0000000010006000-memory.dmp

Filesize
24KB

Download
memory/1128-2-0x0000000010000000-0x0000000010006000-memory.dmp

Filesize
24KB

Download
memory/1128-3-0x0000000010000000-0x0000000010006000-memory.dmp

Filesize
24KB

Download