53b4bb77726d8f6074d984dbc2a07e2b74bc12fbd2d067515d84941ae13a9cab | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-03-2024 22:00

Sharing

Report Analysis Logs

General

Target

00013936.dll
Size

128KB
MD5

0c46c5ca07614ea6d0173c5f956738dc
SHA1

112dbbc0d325ad762e636bab44ed301e30da92c0
SHA256

11cdddf6b55c98793120a0d910202b8910348f66fdd9321298e63aaf80bdbee3
SHA512

2976fcd5e4c59fe23c637f167102acbaf9ebb4381b61d45b0af7eb9995c07a6569020dafa30ffbbe8b97b6410753551999784387e52ca6df17721a58bddf49d7
SSDEEP

768:duJb1gxUbMJ7QpTpQQDyg60QSikwYLhKdMHHairJxNJ7TakQOxcF7Ec:duJb1UME7qDJ60rncdoa633aEzc

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2148 wrote to memory of 2532	2148	rundll32.exe	rundll32.exe
PID 2148 wrote to memory of 2532	2148	rundll32.exe	rundll32.exe
PID 2148 wrote to memory of 2532	2148	rundll32.exe	rundll32.exe
PID 2148 wrote to memory of 2532	2148	rundll32.exe	rundll32.exe
PID 2148 wrote to memory of 2532	2148	rundll32.exe	rundll32.exe
PID 2148 wrote to memory of 2532	2148	rundll32.exe	rundll32.exe
PID 2148 wrote to memory of 2532	2148	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00013936.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2148

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00013936.dll,#1
2⤵
PID:2532

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2532-0-0x0000000000110000-0x0000000000131000-memory.dmp

Filesize
132KB

Download
memory/2532-1-0x0000000000120000-0x0000000000141000-memory.dmp

Filesize
132KB

Download
memory/2532-2-0x0000000000120000-0x0000000000126000-memory.dmp

Filesize
24KB

Download