53b4bb77726d8f6074d984dbc2a07e2b74bc12fbd2d067515d84941ae13a9cab | Triage

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
11-03-2024 22:00

Sharing

Report Analysis Logs

General

Target

00042984.dll
Size

89KB
MD5

6df31760ee55e0fa0059197f6fcfac4c
SHA1

dfe212ea5555891fbf979f1976a5dcfc9109bdd4
SHA256

cbb662728c5915674aadc349a62815208f5a804638ee203f934ae001d533ccb1
SHA512

5a7113d1e2f5e1b114a6e6aad64c25f9f81b543d3d93481fb54438f7d889a649891104e029195724c3446cfa4e037aadb81c0f3ee6cca9893e8f18a2b3c971e6
SSDEEP

1536:DQg0mWzLjNII1zZ3i3bgf1Bw4k1ehrnT2qIK6DF63KQvY3:DEmW5FzZ30bgf1cehlIKaFZQw

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1976 wrote to memory of 2180	1976	rundll32.exe	rundll32.exe
PID 1976 wrote to memory of 2180	1976	rundll32.exe	rundll32.exe
PID 1976 wrote to memory of 2180	1976	rundll32.exe	rundll32.exe
PID 1976 wrote to memory of 2180	1976	rundll32.exe	rundll32.exe
PID 1976 wrote to memory of 2180	1976	rundll32.exe	rundll32.exe
PID 1976 wrote to memory of 2180	1976	rundll32.exe	rundll32.exe
PID 1976 wrote to memory of 2180	1976	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00042984.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00042984.dll,#1
2⤵
PID:2180

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...