9d666fc28b639c2ad9e342af4845a6515b9baf566f2cee9f9bd514bda67161e9 | Triage

Analysis

max time kernel
0s
max time network
4s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b73d13289c532f7a57f12e3c84893394.dll
Size

33KB
MD5

b73d13289c532f7a57f12e3c84893394
SHA1

373b965d9de525952a28a1ead19272419d03e86f
SHA256

9d666fc28b639c2ad9e342af4845a6515b9baf566f2cee9f9bd514bda67161e9
SHA512

733ee886199183783f95cc55a4fd89620553960414f389036473bf4f758ce7449894c41c2d6938dfa95e0511fccd79fb5d49563ae90d5efaf6dbce2038cdec70
SSDEEP

768:KbTdbjsi0jKsWMuft9wqJbkie/buWBa7tTPuLm:sTdEWMOt9wuoiG6Aa1P4m

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 1740	2256	rundll32.exe	28
PID 2256 wrote to memory of 1740	2256	rundll32.exe	28
PID 2256 wrote to memory of 1740	2256	rundll32.exe	28
PID 2256 wrote to memory of 1740	2256	rundll32.exe	28
PID 2256 wrote to memory of 1740	2256	rundll32.exe	28
PID 2256 wrote to memory of 1740	2256	rundll32.exe	28
PID 2256 wrote to memory of 1740	2256	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b73d13289c532f7a57f12e3c84893394.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b73d13289c532f7a57f12e3c84893394.dll,#1
  2⤵
  PID:1740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1740-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/1740-1-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/1740-2-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download