82f0bdbbd3951c7bbc2b2fe6464758ac814b475401cf7d9e87bf2130ba65b419 | Triage

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 04:31

Sharing

Report Analysis Logs

General

Target

bdab29941b9957bfd1a6f80b3941eaf7.dll
Size

29KB
MD5

bdab29941b9957bfd1a6f80b3941eaf7
SHA1

0f3a92b3f442f6c40d383a503d33dd5d404cd9b5
SHA256

82f0bdbbd3951c7bbc2b2fe6464758ac814b475401cf7d9e87bf2130ba65b419
SHA512

423f720c34c8f03ef26fa95dd93e282b5951000c3af4dc3dffe2758285e7dc5f9aa480ccc08e291dd941ef419f82d5cfe434980c87918d8e56e65a946b512513
SSDEEP

768:4UhOBrTv6uPaeVbvci/8f+kUVw7DRriyrfdSb:49V5aeVb0i/8GRw7brFSb

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 1056	2804	rundll32.exe	28
PID 2804 wrote to memory of 1056	2804	rundll32.exe	28
PID 2804 wrote to memory of 1056	2804	rundll32.exe	28
PID 2804 wrote to memory of 1056	2804	rundll32.exe	28
PID 2804 wrote to memory of 1056	2804	rundll32.exe	28
PID 2804 wrote to memory of 1056	2804	rundll32.exe	28
PID 2804 wrote to memory of 1056	2804	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bdab29941b9957bfd1a6f80b3941eaf7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bdab29941b9957bfd1a6f80b3941eaf7.dll,#1
  2⤵
  PID:1056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1056-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download