06f313d8eb8fe03be7ba5526cbddbf11d4124fc755b878424b5432c357e6d77d | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
11-03-2024 14:12

Sharing

Report Analysis Logs

General

Target

c0ca4fe2b49e7ed708a0fd5c61540cbe.dll
Size

498KB
MD5

c0ca4fe2b49e7ed708a0fd5c61540cbe
SHA1

9d594069d0b5b324bdd3d9c442c2a5acd1be4c9e
SHA256

06f313d8eb8fe03be7ba5526cbddbf11d4124fc755b878424b5432c357e6d77d
SHA512

1dca5d6538345292e2f69b28740890392552db5dd166b20ecc523366ae5984040f589eb7cbd58b43889a7a793ab27b7cd4048b2acd9dfaa858b0c9c67329ca9a
SSDEEP

12288:+HBCoMa0X7klxAU/EnvKZ3JFAeSfyd8DtRwNT:+Qk7AMJFAXyxl

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2800	2264	rundll32.exe	28
PID 2264 wrote to memory of 2800	2264	rundll32.exe	28
PID 2264 wrote to memory of 2800	2264	rundll32.exe	28
PID 2264 wrote to memory of 2800	2264	rundll32.exe	28
PID 2264 wrote to memory of 2800	2264	rundll32.exe	28
PID 2264 wrote to memory of 2800	2264	rundll32.exe	28
PID 2264 wrote to memory of 2800	2264	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0ca4fe2b49e7ed708a0fd5c61540cbe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0ca4fe2b49e7ed708a0fd5c61540cbe.dll,#1
  2⤵
  PID:2800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads