42aa52dce2f416c76921f8593c99904b1dca7689cccee5badcd73770515c2d14 | Triage

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
07-03-2024 22:34

Sharing

Report Analysis Logs

General

Target

b9d4f1260a0447d3b20b97123b6c3536.dll
Size

33KB
MD5

b9d4f1260a0447d3b20b97123b6c3536
SHA1

97d6015068a1b7af0013c09cd6e5a4e702c4396d
SHA256

42aa52dce2f416c76921f8593c99904b1dca7689cccee5badcd73770515c2d14
SHA512

8afbbc399f6f8d9c57cce622f17a450ccde35094216de77d957bb6bea0715e84c7ab8ff6c48e764ca2ff07f1d6199624130ac5af8dc2da8db1265a9f050fd81f
SSDEEP

768:y7v1b7TDuSxa/0xyDcl27l5+uMSVOiuGROku9A:yz1b9a/3A47l5+uVFRFu+

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2316	2916	rundll32.exe	28
PID 2916 wrote to memory of 2316	2916	rundll32.exe	28
PID 2916 wrote to memory of 2316	2916	rundll32.exe	28
PID 2916 wrote to memory of 2316	2916	rundll32.exe	28
PID 2916 wrote to memory of 2316	2916	rundll32.exe	28
PID 2916 wrote to memory of 2316	2916	rundll32.exe	28
PID 2916 wrote to memory of 2316	2916	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9d4f1260a0447d3b20b97123b6c3536.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9d4f1260a0447d3b20b97123b6c3536.dll,#1
  2⤵
  PID:2316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads