688d32ff83576727234f4ccc4974b8d415c1026594d78c8940f0cdfa72b915f3 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-03-2024 20:50

Sharing

Report Analysis Logs

General

Target

c6d3fbf785a750f31f200eb2b002afe6.dll
Size

12KB
MD5

c6d3fbf785a750f31f200eb2b002afe6
SHA1

ee79e3c546d348c4091192c4e5d3a113998654e8
SHA256

688d32ff83576727234f4ccc4974b8d415c1026594d78c8940f0cdfa72b915f3
SHA512

69a8544ae6541b1f4e7d93b818dc3f52b351c63ab00a1af4ee6a7d8835e7518e6a328c0d1cc00086864d4e758258090f816199e76c0e63e302e6732d8c9cbe09
SSDEEP

384:jodFJ9ozZbSJgH9RkaoysgM1ug+xKSn8L:jovzKSYbkEa1uFxDC

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 1244	2844	rundll32.exe	28
PID 2844 wrote to memory of 1244	2844	rundll32.exe	28
PID 2844 wrote to memory of 1244	2844	rundll32.exe	28
PID 2844 wrote to memory of 1244	2844	rundll32.exe	28
PID 2844 wrote to memory of 1244	2844	rundll32.exe	28
PID 2844 wrote to memory of 1244	2844	rundll32.exe	28
PID 2844 wrote to memory of 1244	2844	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c6d3fbf785a750f31f200eb2b002afe6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c6d3fbf785a750f31f200eb2b002afe6.dll,#1
  2⤵
  PID:1244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1244-0-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download
memory/1244-1-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download
memory/1244-2-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download
memory/1244-3-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download