a47fc4aa6c8a864a4f1501458b9102992d7442b5576a259767e28a5665bb0593 | Triage

Analysis

max time kernel
0s
max time network
0s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c946ccd2c6d3494aedd206ba223218ad.dll
Size

220KB
MD5

c946ccd2c6d3494aedd206ba223218ad
SHA1

3dc60db3282c5e8842bb95ecc488adda6a03743c
SHA256

a47fc4aa6c8a864a4f1501458b9102992d7442b5576a259767e28a5665bb0593
SHA512

19fab1f9aa5bf2f4ac8b5282d0075dc57aa0d2eb83ee458fd2658289d9726829a0bfc2e5d420f551c5cde1753a37525c11d7ad7cf4e13775879789e8cf2b9e6a
SSDEEP

6144:qafix/dnhwWbLE4Wmy5z8WRKqZKW8f0ZPZi4kfYjLDt:Rf6mms1WBsm/Mt

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 1680	2792	rundll32.exe	28
PID 2792 wrote to memory of 1680	2792	rundll32.exe	28
PID 2792 wrote to memory of 1680	2792	rundll32.exe	28
PID 2792 wrote to memory of 1680	2792	rundll32.exe	28
PID 2792 wrote to memory of 1680	2792	rundll32.exe	28
PID 2792 wrote to memory of 1680	2792	rundll32.exe	28
PID 2792 wrote to memory of 1680	2792	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c946ccd2c6d3494aedd206ba223218ad.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c946ccd2c6d3494aedd206ba223218ad.dll,#1
  2⤵
  PID:1680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1680-0-0x0000000002070000-0x00000000021E0000-memory.dmp

Filesize
1.4MB

Download
memory/1680-1-0x0000000002070000-0x00000000021E0000-memory.dmp

Filesize
1.4MB

Download