a9699d8b6b67b7db7e0a465119bbd0034775243fbcd30d447fabc69ca609df8b | Triage

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12-03-2024 11:03

Sharing

Report Analysis Logs

General

Target

c332768c6830c8f4dd356586a1c98eb7.dll
Size

256KB
MD5

c332768c6830c8f4dd356586a1c98eb7
SHA1

1988685d41b95a5203f5206de3a9cac7b3f9b646
SHA256

a9699d8b6b67b7db7e0a465119bbd0034775243fbcd30d447fabc69ca609df8b
SHA512

3e9cd8effb6cf4953a42a0b6b56460b5a90483f17758a49d10e8817d5b6566908acb575fe6255cda484d7a83ef90bb7ccf25abe92f710e73dfeb7748f11d8a85
SSDEEP

6144:592d9+N6JtNoRyDdoAU4eWUtGXOUyrpykECVEve:f89+Mta7AUCUtKta1ECVn

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2248	1728	rundll32.exe	28
PID 1728 wrote to memory of 2248	1728	rundll32.exe	28
PID 1728 wrote to memory of 2248	1728	rundll32.exe	28
PID 1728 wrote to memory of 2248	1728	rundll32.exe	28
PID 1728 wrote to memory of 2248	1728	rundll32.exe	28
PID 1728 wrote to memory of 2248	1728	rundll32.exe	28
PID 1728 wrote to memory of 2248	1728	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c332768c6830c8f4dd356586a1c98eb7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c332768c6830c8f4dd356586a1c98eb7.dll,#1
  2⤵
  PID:2248

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2248-0-0x0000000010000000-0x000000001005F000-memory.dmp

Filesize
380KB

Download
memory/2248-1-0x0000000010000000-0x000000001005F000-memory.dmp

Filesize
380KB

Download