3618eb3131d094c9f650e8a6121f114819dcf0e78bebbd762f4fe5528d981ce8 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-03-2024 23:06

Sharing

Report Analysis Logs

General

Target

c9dc4a8ada90fdae9ac7548f46c73df0.dll
Size

55KB
MD5

c9dc4a8ada90fdae9ac7548f46c73df0
SHA1

bbd637afb0b233bdb6275d5b1bcfa0b8742d3bd5
SHA256

3618eb3131d094c9f650e8a6121f114819dcf0e78bebbd762f4fe5528d981ce8
SHA512

d3c0e9282c008f1077208a2a7e7dff70c3ef35440b3c6457662e28fc225df837be704b3b3eccc37ec723d232fac26bad4af6cc73476ccdbba2482fc93d4f5786
SSDEEP

1536:cInUmvCj/2lqFJ6PdudkpwMNh6i6ILCVJk3Y:QglqFqdaKXLw

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2352	2020	rundll32.exe	28
PID 2020 wrote to memory of 2352	2020	rundll32.exe	28
PID 2020 wrote to memory of 2352	2020	rundll32.exe	28
PID 2020 wrote to memory of 2352	2020	rundll32.exe	28
PID 2020 wrote to memory of 2352	2020	rundll32.exe	28
PID 2020 wrote to memory of 2352	2020	rundll32.exe	28
PID 2020 wrote to memory of 2352	2020	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c9dc4a8ada90fdae9ac7548f46c73df0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c9dc4a8ada90fdae9ac7548f46c73df0.dll,#1
  2⤵
  PID:2352

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2352-0-0x0000000000100000-0x0000000000112000-memory.dmp

Filesize
72KB

Download