15becf4b0f68fc89083a9ac62a616c0f29d260a7cdab9cc5aa0bb738c54466ed | Triage

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
09-03-2024 22:57

Sharing

Report Analysis Logs

General

Target

bd05867914ac5ae71e43a54c9374240d.dll
Size

20KB
MD5

bd05867914ac5ae71e43a54c9374240d
SHA1

ee059491dddec5004db95327b831b7d2aad1bc2d
SHA256

15becf4b0f68fc89083a9ac62a616c0f29d260a7cdab9cc5aa0bb738c54466ed
SHA512

6d4a28abd6e9b6883e463f1449ef5b3f0aa8e77ab6ddd5352afb7d022449f2ef32f15146c103b6727949770fc6e50aa4eb49b3bb986cbd3968fc63fe6091c807
SSDEEP

384:VQYTFxIorE9cIgwAe+1iM/hBI2v7qmEukcXl/h/qp4n9:VndE9eMMJZdE4Z/qp49

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2552	2104	rundll32.exe	28
PID 2104 wrote to memory of 2552	2104	rundll32.exe	28
PID 2104 wrote to memory of 2552	2104	rundll32.exe	28
PID 2104 wrote to memory of 2552	2104	rundll32.exe	28
PID 2104 wrote to memory of 2552	2104	rundll32.exe	28
PID 2104 wrote to memory of 2552	2104	rundll32.exe	28
PID 2104 wrote to memory of 2552	2104	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd05867914ac5ae71e43a54c9374240d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd05867914ac5ae71e43a54c9374240d.dll,#1
  2⤵
  PID:2552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads