90eb14763a17e64fe26e5cb8ce0df06c6b2fec782efd76351005455d6f6def67 | Triage

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 07:36

Sharing

Report Analysis Logs

General

Target

c810aba338ef4a3dcc43bfff2246e6aa.dll
Size

3KB
MD5

c810aba338ef4a3dcc43bfff2246e6aa
SHA1

5ff7e749e0b0b857a3ae4e9bf0738d4e5cb0118f
SHA256

90eb14763a17e64fe26e5cb8ce0df06c6b2fec782efd76351005455d6f6def67
SHA512

77d24133547bd72930b78f0911a72df172e3a464f4f83b96dfec1d215032de83506080410819718e5deed1387cf051401a7d1b22c358505c9000efe807afe5ab

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 1884	2516	rundll32.exe	28
PID 2516 wrote to memory of 1884	2516	rundll32.exe	28
PID 2516 wrote to memory of 1884	2516	rundll32.exe	28
PID 2516 wrote to memory of 1884	2516	rundll32.exe	28
PID 2516 wrote to memory of 1884	2516	rundll32.exe	28
PID 2516 wrote to memory of 1884	2516	rundll32.exe	28
PID 2516 wrote to memory of 1884	2516	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c810aba338ef4a3dcc43bfff2246e6aa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c810aba338ef4a3dcc43bfff2246e6aa.dll,#1
  2⤵
  PID:1884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads