58ab2f11d6c5289c2b255885a5ebe681288fd8b97f0c9621d0b8a6616becd178 | Triage

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 13:11

Sharing

Report Analysis Logs

General

Target

cb7eed08608903b7117e2486758a8491.dll
Size

36KB
MD5

cb7eed08608903b7117e2486758a8491
SHA1

75bd268913369185978f3c034e9c9be1ebd8d96f
SHA256

58ab2f11d6c5289c2b255885a5ebe681288fd8b97f0c9621d0b8a6616becd178
SHA512

1acd2a2b112c6d8eb00ccb4e1b5bde8e0ea6ce6ac963b8b93f4ae4380574db4271e86d10e35d93e6690d200c618720ad6ea53f1ff1c3862143dc2c5ebd96a893
SSDEEP

768:eRoftihkMWdd+rEUm5c41DBBQARQkRXFwfwo:QsqkDn+rEUWTBBQARBMwo

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 2204	1664	rundll32.exe	28
PID 1664 wrote to memory of 2204	1664	rundll32.exe	28
PID 1664 wrote to memory of 2204	1664	rundll32.exe	28
PID 1664 wrote to memory of 2204	1664	rundll32.exe	28
PID 1664 wrote to memory of 2204	1664	rundll32.exe	28
PID 1664 wrote to memory of 2204	1664	rundll32.exe	28
PID 1664 wrote to memory of 2204	1664	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb7eed08608903b7117e2486758a8491.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb7eed08608903b7117e2486758a8491.dll,#1
  2⤵
  PID:2204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads