34c79077112ac8eccb61c294b0da78f24d25b48ee5fbcfff68ada35194eb5a34 | Triage

Analysis

max time kernel
121s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 00:36

Sharing

Report Analysis Logs

General

Target

c4858a2ecf83a8733f508b8e1034f502.dll
Size

106KB
MD5

c4858a2ecf83a8733f508b8e1034f502
SHA1

ed325871cbeff77ea532cc6af7f7c277de9bd193
SHA256

34c79077112ac8eccb61c294b0da78f24d25b48ee5fbcfff68ada35194eb5a34
SHA512

907eb5d7fa609240fcc0208bab015357ce615a7b4620f00fb05ff836c8b27049a1264ec7e1637112b91c08ebaad538b9e1f7fbe2e082d4ab9ec63e1427708c8a
SSDEEP

3072:OzqEnoE6FMiKMjSMAowt5mPWTEAtSQi8bqxx8:kqEgKwSMefuW1SG

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2956	2476	rundll32.exe	28
PID 2476 wrote to memory of 2956	2476	rundll32.exe	28
PID 2476 wrote to memory of 2956	2476	rundll32.exe	28
PID 2476 wrote to memory of 2956	2476	rundll32.exe	28
PID 2476 wrote to memory of 2956	2476	rundll32.exe	28
PID 2476 wrote to memory of 2956	2476	rundll32.exe	28
PID 2476 wrote to memory of 2956	2476	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c4858a2ecf83a8733f508b8e1034f502.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c4858a2ecf83a8733f508b8e1034f502.dll,#1
  2⤵
  PID:2956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2956-0-0x00000000698C0000-0x00000000698E1000-memory.dmp

Filesize
132KB

Download
memory/2956-1-0x00000000698C0000-0x00000000698E1000-memory.dmp

Filesize
132KB

Download
memory/2956-2-0x00000000698C0000-0x00000000698E1000-memory.dmp

Filesize
132KB

Download
memory/2956-3-0x00000000698C0000-0x00000000698E1000-memory.dmp

Filesize
132KB

Download