0dc7dc260c73a1c6de6082f67ca2bf8ac9c5f267876306b9c9eb7d8f1f502ed8 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 22:41

Sharing

Report Analysis Logs

General

Target

c1c9d5d930a35cdc4b6b26ee124510c5.dll
Size

17KB
MD5

c1c9d5d930a35cdc4b6b26ee124510c5
SHA1

f7ea82c0a660e3ef33d536e62a0fc707df30220b
SHA256

0dc7dc260c73a1c6de6082f67ca2bf8ac9c5f267876306b9c9eb7d8f1f502ed8
SHA512

db15e842a37cc3fe2776579bc86a37135b4d7c3494ce22fa517b91e90fe805177169963ffc50e43ce59fc46c7f3f7d721fb7453f154aa47ea74c50706c0cb87e
SSDEEP

384:6FveO0HneGQ/asfk1en8LHgFBDGqGpBkT:k/0Hne/sc8LWBDG6T

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 1276	2796	rundll32.exe	28
PID 2796 wrote to memory of 1276	2796	rundll32.exe	28
PID 2796 wrote to memory of 1276	2796	rundll32.exe	28
PID 2796 wrote to memory of 1276	2796	rundll32.exe	28
PID 2796 wrote to memory of 1276	2796	rundll32.exe	28
PID 2796 wrote to memory of 1276	2796	rundll32.exe	28
PID 2796 wrote to memory of 1276	2796	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c1c9d5d930a35cdc4b6b26ee124510c5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c1c9d5d930a35cdc4b6b26ee124510c5.dll,#1
  2⤵
  PID:1276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1276-0-0x0000000010000000-0x000000001006C000-memory.dmp

Filesize
432KB

Download