75c509cf812c55d70a91f2b7be1c0da1cbfede411c22c3c111cdc01f751560f6 | Triage

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 20:39

Sharing

Report Analysis Logs

General

Target

b59b8eb1a2a4f8a5df765c826b5e3517.dll
Size

3KB
MD5

b59b8eb1a2a4f8a5df765c826b5e3517
SHA1

e94ed755cbf80c3cc88f1e1906c5b662e7c88d53
SHA256

75c509cf812c55d70a91f2b7be1c0da1cbfede411c22c3c111cdc01f751560f6
SHA512

878a80773eb7d169bb4533e5ffb04876deab0c3acad3b12e0004e027b8d32ce41e644a212075c6feda111bb9d6eac699b805c8660a66b6b6be2e1fa182bf671a

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2748	1704	rundll32.exe	28
PID 1704 wrote to memory of 2748	1704	rundll32.exe	28
PID 1704 wrote to memory of 2748	1704	rundll32.exe	28
PID 1704 wrote to memory of 2748	1704	rundll32.exe	28
PID 1704 wrote to memory of 2748	1704	rundll32.exe	28
PID 1704 wrote to memory of 2748	1704	rundll32.exe	28
PID 1704 wrote to memory of 2748	1704	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b59b8eb1a2a4f8a5df765c826b5e3517.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b59b8eb1a2a4f8a5df765c826b5e3517.dll,#1
  2⤵
  PID:2748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads