a7bfd96903dbaf1d9e478ea1774e22973f4f16a57a28e99bc32eb1427ee09357 | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 21:20

Sharing

Report Analysis Logs

General

Target

b8376808cd5c570a34115ff014c89c9f.dll
Size

4.2MB
MD5

b8376808cd5c570a34115ff014c89c9f
SHA1

e6da86ea0f944e62f574548b75357b781c73a2ea
SHA256

a7bfd96903dbaf1d9e478ea1774e22973f4f16a57a28e99bc32eb1427ee09357
SHA512

3f5a00793cb9039a710910e3ba5fbd417782a0aa3b6ad589710de8ab92c4e1a28abaaaff40b2c42e2d3d500ee8cbccc9e550b80ac699b6543245706726d3e38b
SSDEEP

98304:7JgfEwcXUs9IvPJ6vNYWld6fswviHkJO5ss0vJ2vAe:lgfE7XUs9IvPJeq2Ye

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2388	2372	rundll32.exe	28
PID 2372 wrote to memory of 2388	2372	rundll32.exe	28
PID 2372 wrote to memory of 2388	2372	rundll32.exe	28
PID 2372 wrote to memory of 2388	2372	rundll32.exe	28
PID 2372 wrote to memory of 2388	2372	rundll32.exe	28
PID 2372 wrote to memory of 2388	2372	rundll32.exe	28
PID 2372 wrote to memory of 2388	2372	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b8376808cd5c570a34115ff014c89c9f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b8376808cd5c570a34115ff014c89c9f.dll,#1
  2⤵
  PID:2388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads