11d2552502822dcdbc73eaa9d3227e2780cef0fc2acf4704e4a4a1031487e0f6 | Triage

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 00:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bd3a2325ab63cfdf049a723b50082750.dll
Size

510KB
MD5

bd3a2325ab63cfdf049a723b50082750
SHA1

2e509b275f8e3d8de6bf4e48dac90c9e4d74fed4
SHA256

11d2552502822dcdbc73eaa9d3227e2780cef0fc2acf4704e4a4a1031487e0f6
SHA512

212df6c0aa0d7dc29d902809422335cd5f0325a746a62fa51b8b8c1c173c670b6494b41bb25f383ed02eaa797828dc94261c4bfd404f95e89b2a5ed1bc61e526
SSDEEP

12288:4DLZfnglu2BpLiPwlUfIKKuioD4LP22dwfEt6KBc:4DBgllsQUfIKKuZAP2Wq

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 2700	1764	rundll32.exe	28
PID 1764 wrote to memory of 2700	1764	rundll32.exe	28
PID 1764 wrote to memory of 2700	1764	rundll32.exe	28
PID 1764 wrote to memory of 2700	1764	rundll32.exe	28
PID 1764 wrote to memory of 2700	1764	rundll32.exe	28
PID 1764 wrote to memory of 2700	1764	rundll32.exe	28
PID 1764 wrote to memory of 2700	1764	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd3a2325ab63cfdf049a723b50082750.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd3a2325ab63cfdf049a723b50082750.dll,#1
  2⤵
  PID:2700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads