3b15085cfa2dfbbdfac9734b88d398301f75db88eecbb7da92ee931a8dfb1c11 | Triage

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 17:07

Sharing

Report Analysis Logs

General

Target

c92798f6c0f75b6b752febefad53e34e.dll
Size

72KB
MD5

c92798f6c0f75b6b752febefad53e34e
SHA1

cf65f895ad4a7289f6f0dac2f64ce5c3ef147559
SHA256

3b15085cfa2dfbbdfac9734b88d398301f75db88eecbb7da92ee931a8dfb1c11
SHA512

a39a32be28b0289d50eaf86a53eabf7cddc79efdf044c4d584074490286ef41b5c43874fdd9b295176e0e717a72165dc18a8e126b9ce015118160e09709b0c8a
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 2020	1092	rundll32.exe	28
PID 1092 wrote to memory of 2020	1092	rundll32.exe	28
PID 1092 wrote to memory of 2020	1092	rundll32.exe	28
PID 1092 wrote to memory of 2020	1092	rundll32.exe	28
PID 1092 wrote to memory of 2020	1092	rundll32.exe	28
PID 1092 wrote to memory of 2020	1092	rundll32.exe	28
PID 1092 wrote to memory of 2020	1092	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c92798f6c0f75b6b752febefad53e34e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c92798f6c0f75b6b752febefad53e34e.dll,#1
  2⤵
  PID:2020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads