52ed440aa643c06a63db44a5572d2c97225d11934fa36c8b54172cf6de3cdc0c | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
27-02-2024 19:17

Sharing

Report Analysis Logs

General

Target

Communicate.dll
Size

44KB
MD5

102b9fe06b7a8cad9af32737308cf707
SHA1

eb0743e1a849f5331ecf1ac8dc68c440f220fb0c
SHA256

d8c3c617831db57e6f8ab272dd9b2b9f7ea8002229c4df1a9db5d921e8c61876
SHA512

77c9cb2a93f8c8de06ea29ab28f8969cd2bafae0ff2aa594b6f60aaab30ff3b98fa87152ef9fa3f8a69426a9f4734ddcd82635cd49118f9781ef7bfde918bc8f
SSDEEP

768:UJd5AiLoDQ/4+TnGvippFxqWLCxfFHoUpw:UJd5AiP4+Tngip34thov

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 2960	1776	rundll32.exe	28
PID 1776 wrote to memory of 2960	1776	rundll32.exe	28
PID 1776 wrote to memory of 2960	1776	rundll32.exe	28
PID 1776 wrote to memory of 2960	1776	rundll32.exe	28
PID 1776 wrote to memory of 2960	1776	rundll32.exe	28
PID 1776 wrote to memory of 2960	1776	rundll32.exe	28
PID 1776 wrote to memory of 2960	1776	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Communicate.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Communicate.dll,#1
  2⤵
  PID:2960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads