30c0e919cfbe8f0a830de28769654777b56373c6179704ed2b265048f4047173 | Triage

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-02-2024 18:46

Sharing

Report Analysis Logs

General

Target

ac9642fe697d0d24174b19114faa8da0.dll
Size

33KB
MD5

ac9642fe697d0d24174b19114faa8da0
SHA1

f1935b41803b54172ff5fddf1c59445ef929425e
SHA256

30c0e919cfbe8f0a830de28769654777b56373c6179704ed2b265048f4047173
SHA512

a1bf7b3ca3648bda88d5fa247b692c5885ed744611d93dafeb2f125a72e03db1b1c981c3dd19d2740a42f090a93fdf31f2d779efb9222917df364302b8bca788
SSDEEP

768:UbaJbRi37mJSLuKoGPsJwyp5zwDIXQ8rzRgiMXy:UbaRAKJRG0gIXR8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2668	2160	rundll32.exe	28
PID 2160 wrote to memory of 2668	2160	rundll32.exe	28
PID 2160 wrote to memory of 2668	2160	rundll32.exe	28
PID 2160 wrote to memory of 2668	2160	rundll32.exe	28
PID 2160 wrote to memory of 2668	2160	rundll32.exe	28
PID 2160 wrote to memory of 2668	2160	rundll32.exe	28
PID 2160 wrote to memory of 2668	2160	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac9642fe697d0d24174b19114faa8da0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac9642fe697d0d24174b19114faa8da0.dll,#1
  2⤵
  PID:2668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads