7be23d158b89ff65e50a299921f558f7a37d6e1be6ff802281383a0b931d0799 | Triage

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 06:22

Sharing

Report Analysis Logs

General

Target

bde3e413b4919fde1b0504d88fe7dcd4.dll
Size

106KB
MD5

bde3e413b4919fde1b0504d88fe7dcd4
SHA1

4d07fb3f8f545c90a91f6be622e9d3a032551a8f
SHA256

7be23d158b89ff65e50a299921f558f7a37d6e1be6ff802281383a0b931d0799
SHA512

c5b616a98c9a4fb253a57c28ac001f5145c8b95c10843d3dc6670b63ec5fc5c6cb7d9680938f982ad3d5eb64a54159b77da7fdf1320332ef8a391b9d2dba5662
SSDEEP

768:i4kmcL9TAxP7dbOLWKUqcNZk6iPY8cawcXdD:i4k/9TydaLW1qctaldD

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2600	2120	rundll32.exe	28
PID 2120 wrote to memory of 2600	2120	rundll32.exe	28
PID 2120 wrote to memory of 2600	2120	rundll32.exe	28
PID 2120 wrote to memory of 2600	2120	rundll32.exe	28
PID 2120 wrote to memory of 2600	2120	rundll32.exe	28
PID 2120 wrote to memory of 2600	2120	rundll32.exe	28
PID 2120 wrote to memory of 2600	2120	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bde3e413b4919fde1b0504d88fe7dcd4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bde3e413b4919fde1b0504d88fe7dcd4.dll,#1
  2⤵
  PID:2600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2600-0-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download
memory/2600-1-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download
memory/2600-2-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download