c33a53f382da8ba050b2d924c3f70bc82918110a753450b857c42ad3b7e6c152 | Triage

Analysis

max time kernel
153s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-02-2024 12:06

Sharing

Report Analysis Logs

General

Target

a1d4cdeefb2ce7f4a11152795414a4a4.dll
Size

113KB
MD5

a1d4cdeefb2ce7f4a11152795414a4a4
SHA1

dd6a980d994489129e02871e2722bf2fd1b2e106
SHA256

c33a53f382da8ba050b2d924c3f70bc82918110a753450b857c42ad3b7e6c152
SHA512

3c8e9da2077154ec6f8daa687997a9a320ba59bfa58b3c083985a13c153c52a87eabc41fa0a706052bce431434d942f858e6c2076d8e7d755a93433a64bb0403
SSDEEP

3072:rMl4Is++GTAA65fChZPT9r0EyoUZ4n+nwQyg:rBIkA+67TNXUZx3y

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
2092	rundll32.exe
2092	rundll32.exe
2092	rundll32.exe
2092	rundll32.exe
2092	rundll32.exe
2092	rundll32.exe
2092	rundll32.exe
2092	rundll32.exe
2092	rundll32.exe
2092	rundll32.exe
2092	rundll32.exe
2092	rundll32.exe
2092	rundll32.exe
2092	rundll32.exe
2092	rundll32.exe
2092	rundll32.exe
2092	rundll32.exe
2092	rundll32.exe
2092	rundll32.exe
2092	rundll32.exe
2092	rundll32.exe
2092	rundll32.exe
2092	rundll32.exe
2092	rundll32.exe
2092	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2092	2072	rundll32.exe	28
PID 2072 wrote to memory of 2092	2072	rundll32.exe	28
PID 2072 wrote to memory of 2092	2072	rundll32.exe	28
PID 2072 wrote to memory of 2092	2072	rundll32.exe	28
PID 2072 wrote to memory of 2092	2072	rundll32.exe	28
PID 2072 wrote to memory of 2092	2072	rundll32.exe	28
PID 2072 wrote to memory of 2092	2072	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1d4cdeefb2ce7f4a11152795414a4a4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1d4cdeefb2ce7f4a11152795414a4a4.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads