044bbcf71ab892f2065c22944715263665d574ada1e44681eeaed74d928b1c00 | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 02:06

Sharing

Report Analysis Logs

General

Target

aab9ef3e7e40a0ca053d5528c956e072.dll
Size

72KB
MD5

aab9ef3e7e40a0ca053d5528c956e072
SHA1

38cada64a5ed0f9ef78b8490c7248db257c3b40f
SHA256

044bbcf71ab892f2065c22944715263665d574ada1e44681eeaed74d928b1c00
SHA512

a18e1fb9be156885b3a9d9eab5cd9230c3c14cf031ed306452e4a4252db94b32201d49fc1c7b3daa38d88eda202ff5281cbbc71ebfca6c81d352d069254bff85
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 2796	848	rundll32.exe	28
PID 848 wrote to memory of 2796	848	rundll32.exe	28
PID 848 wrote to memory of 2796	848	rundll32.exe	28
PID 848 wrote to memory of 2796	848	rundll32.exe	28
PID 848 wrote to memory of 2796	848	rundll32.exe	28
PID 848 wrote to memory of 2796	848	rundll32.exe	28
PID 848 wrote to memory of 2796	848	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aab9ef3e7e40a0ca053d5528c956e072.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\aab9ef3e7e40a0ca053d5528c956e072.dll,#1
  2⤵
  PID:2796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads