00335ac2ede76fa9f1a1c7fce54cc57263c594bcf14708d752b6d5b88015332a | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/02/2024, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

_1B4DC5A2E06842A2AF67D90F083EA79B.dll
Size

18KB
MD5

6b9084b8125f776245f8080a0f5f92ec
SHA1

72ab2f42654c670dae53f8e75b6d5011bbaba525
SHA256

9830f7c286284753ca70d94ae90a40ab72a1fa89897eeae8b8c72e4f45de3aaf
SHA512

9ef5ce7656f524f643f1e882fbb1a540ae339633d23e77a66aeb3f0756bba93c6afaa3c9ada9727398e2180d04f7a7b0cc919037bee1ceaa8d01f8cdb60c6d8f
SSDEEP

384:UpcY8FpLGOTk5jLwPt92GLpNyoNNUxB4ahAS:IcJPjkBoDDyNFWS

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2028	2080	rundll32.exe	28
PID 2080 wrote to memory of 2028	2080	rundll32.exe	28
PID 2080 wrote to memory of 2028	2080	rundll32.exe	28
PID 2080 wrote to memory of 2028	2080	rundll32.exe	28
PID 2080 wrote to memory of 2028	2080	rundll32.exe	28
PID 2080 wrote to memory of 2028	2080	rundll32.exe	28
PID 2080 wrote to memory of 2028	2080	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\_1B4DC5A2E06842A2AF67D90F083EA79B.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\_1B4DC5A2E06842A2AF67D90F083EA79B.dll,#1
  2⤵
  PID:2028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2028-0-0x0000000000120000-0x0000000000123000-memory.dmp

Filesize
12KB

Download
memory/2028-1-0x0000000000120000-0x0000000000123000-memory.dmp

Filesize
12KB

Download
memory/2028-2-0x0000000000130000-0x0000000000133000-memory.dmp

Filesize
12KB

Download
memory/2028-3-0x0000000000130000-0x0000000000132000-memory.dmp

Filesize
8KB

Download