09a03fa9a9b91cfe0bcfe7a8d98e042abf2a65fcd0222a41bde61c81bf9a3761 | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/02/2024, 06:11

Sharing

Report Analysis Logs

General

Target

a3146ba3bfd6ef2bfb45c0c069a2fb8b.dll
Size

26KB
MD5

a3146ba3bfd6ef2bfb45c0c069a2fb8b
SHA1

8e7613102338f8210ab88b264e8c5e5bfcbf1c87
SHA256

09a03fa9a9b91cfe0bcfe7a8d98e042abf2a65fcd0222a41bde61c81bf9a3761
SHA512

de59c48de9a7841f0c67fd31cbb818aeaad1acba74c2bc44cc2237255d514b3eda1a90e67a6d39355b858ff700210a809cf9039ba299e536a1d10a30c282d5e8
SSDEEP

768:+dsLPYIhpZT6YOrAaaV9Y5ivTNzztrHDOajs4F:qsLQIdT3uonvTNzztrbh

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 1648	2528	rundll32.exe	28
PID 2528 wrote to memory of 1648	2528	rundll32.exe	28
PID 2528 wrote to memory of 1648	2528	rundll32.exe	28
PID 2528 wrote to memory of 1648	2528	rundll32.exe	28
PID 2528 wrote to memory of 1648	2528	rundll32.exe	28
PID 2528 wrote to memory of 1648	2528	rundll32.exe	28
PID 2528 wrote to memory of 1648	2528	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3146ba3bfd6ef2bfb45c0c069a2fb8b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3146ba3bfd6ef2bfb45c0c069a2fb8b.dll,#1
  2⤵
  PID:1648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1648-0-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/1648-1-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/1648-2-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/1648-3-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download