2d4f134af9291beecebc4d434948e15e5442ba3b5e3b27af0eb064754bc89308 | Triage

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 19:27

Sharing

Report Analysis Logs

General

Target

c6af4825563aed7396ce6e625ba102ca.dll
Size

44KB
MD5

c6af4825563aed7396ce6e625ba102ca
SHA1

ea80425427b99bf3634d4ae4011e8307b6e6c75a
SHA256

2d4f134af9291beecebc4d434948e15e5442ba3b5e3b27af0eb064754bc89308
SHA512

18d8f116642b7b70ce36d7d1c6ef11d5d64f0f4a8715d3143e0a0ec7c488986de5cdeece6010634b35b427a69d81d3f53c5bec1c8269c36f10ed07a5b7265001
SSDEEP

768:ihJ2LY2wlig06TYtoslXskYgxe4R/eGY+kwb5JE:ukwMgXCoUXFYh4R/Eyb5

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2052	2240	rundll32.exe	28
PID 2240 wrote to memory of 2052	2240	rundll32.exe	28
PID 2240 wrote to memory of 2052	2240	rundll32.exe	28
PID 2240 wrote to memory of 2052	2240	rundll32.exe	28
PID 2240 wrote to memory of 2052	2240	rundll32.exe	28
PID 2240 wrote to memory of 2052	2240	rundll32.exe	28
PID 2240 wrote to memory of 2052	2240	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c6af4825563aed7396ce6e625ba102ca.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c6af4825563aed7396ce6e625ba102ca.dll,#1
  2⤵
  PID:2052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2052-0-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2052-1-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2052-2-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download