d24de1adceadc3ddf8728b880003b78f595585b8278afd78c642ae08a894a9ef | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-03-2024 23:40

Sharing

Report Analysis Logs

General

Target

b5f374425734d7d889188c8fb7adf2b3.dll
Size

15KB
MD5

b5f374425734d7d889188c8fb7adf2b3
SHA1

ec75806b912a4747b19663be4850eb13a83cb9bb
SHA256

d24de1adceadc3ddf8728b880003b78f595585b8278afd78c642ae08a894a9ef
SHA512

58c06a17d2cad3d478f4524f83d250c7bedcc613502c0104965f8238bf36f76140dbcd3658c44335bb93b5d181381d77ac4076ab161fe92b8141485d8cc69fb3
SSDEEP

384:TxSDqRyY9pGT5SywikbuXIx3WetR0XqrZ:cY7Gd/whbBxGez0Xq

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2196	2372	rundll32.exe	28
PID 2372 wrote to memory of 2196	2372	rundll32.exe	28
PID 2372 wrote to memory of 2196	2372	rundll32.exe	28
PID 2372 wrote to memory of 2196	2372	rundll32.exe	28
PID 2372 wrote to memory of 2196	2372	rundll32.exe	28
PID 2372 wrote to memory of 2196	2372	rundll32.exe	28
PID 2372 wrote to memory of 2196	2372	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b5f374425734d7d889188c8fb7adf2b3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b5f374425734d7d889188c8fb7adf2b3.dll,#1
  2⤵
  PID:2196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2196-0-0x0000000000190000-0x0000000000196000-memory.dmp

Filesize
24KB

Download