1ec79bc060be456223b006db754341d6e5996782c4dbfc8e76538b22e544a07f | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 10:17

Sharing

Report Analysis Logs

General

Target

cb26e1851da714fcf9a8293823b924c6.dll
Size

60KB
MD5

cb26e1851da714fcf9a8293823b924c6
SHA1

64836063b25dcceb1f3bc114a844ebe678527144
SHA256

1ec79bc060be456223b006db754341d6e5996782c4dbfc8e76538b22e544a07f
SHA512

a91003f97f8872563db24bd6c6d813b6115e066d41f99bd48ba2d222b05dc41e5613b1ba5fee4a8dc4bec1d91adb9a754ae1a55a071cbbb3df21a9c89007c664
SSDEEP

1536:iNqwLyQkjJLTA1kB7S8lKoG0M4Ppn8Npnu2x:4+J58kBvKpH4i5ug

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 1260	912	rundll32.exe	28
PID 912 wrote to memory of 1260	912	rundll32.exe	28
PID 912 wrote to memory of 1260	912	rundll32.exe	28
PID 912 wrote to memory of 1260	912	rundll32.exe	28
PID 912 wrote to memory of 1260	912	rundll32.exe	28
PID 912 wrote to memory of 1260	912	rundll32.exe	28
PID 912 wrote to memory of 1260	912	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb26e1851da714fcf9a8293823b924c6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb26e1851da714fcf9a8293823b924c6.dll,#1
  2⤵
  PID:1260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1260-0-0x0000000000180000-0x0000000000193000-memory.dmp

Filesize
76KB

Download