a096845d6c5f7ca8a131768cbe86b57fb70c39612110ad819617117e9b08a1ae | Triage

Analysis

max time kernel
119s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-03-2024 00:17

Sharing

Report Analysis Logs

General

Target

System.ComponentModel.dll
Size

30KB
MD5

6972a286b196cea3b21c77a37c0cd329
SHA1

bf3e9081156f9518ac46b692f55edd5e70147b6f
SHA256

0d2cd39b276ecb4072873ff5227e6e510ef130b1113acb0eb1bf46b275c0b513
SHA512

81abb2c0cbdbd06ab21adfff126d8356221db892d04dcd7d09c5052cf1199bee9e652625c7e91700b0f918cd57031476a35de8d78b1332aceb6c0fa2416d8944
SSDEEP

384:pW4X1WCnTySJXgb+MH8AAB5kHRN7LR9z3BTsT2:FYLRd9z3Bm2

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2908	2224	rundll32.exe	28
PID 2224 wrote to memory of 2908	2224	rundll32.exe	28
PID 2224 wrote to memory of 2908	2224	rundll32.exe	28
PID 2224 wrote to memory of 2908	2224	rundll32.exe	28
PID 2224 wrote to memory of 2908	2224	rundll32.exe	28
PID 2224 wrote to memory of 2908	2224	rundll32.exe	28
PID 2224 wrote to memory of 2908	2224	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\System.ComponentModel.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\System.ComponentModel.dll,#1
  2⤵
  PID:2908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads