40f6a3bfe21ff6db2f786731fcca0b58c4800555ad9c0ed8b2741ae5edd127b1 | Triage

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/03/2024, 01:05

Sharing

Report Analysis Logs

General

Target

ccb691d1defdbb291174d4eee54687c6.dll
Size

35KB
MD5

ccb691d1defdbb291174d4eee54687c6
SHA1

a86e51e76759b3e1c872bfbe367158e98e22f4fe
SHA256

40f6a3bfe21ff6db2f786731fcca0b58c4800555ad9c0ed8b2741ae5edd127b1
SHA512

ba6f654453ebf8006d1b11004f0e6ebfd6897594db03935670fcd4bb784696574f921419611d777118392b69b5f537df8cfca45114434fa2b5c1a0c369004cec
SSDEEP

768:cWN54K+rLCOP+u1s4WiDy93tlNF2Yxr/ciOVmYk:O6hrdVNoYlmmYk

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2076	2992	rundll32.exe	28
PID 2992 wrote to memory of 2076	2992	rundll32.exe	28
PID 2992 wrote to memory of 2076	2992	rundll32.exe	28
PID 2992 wrote to memory of 2076	2992	rundll32.exe	28
PID 2992 wrote to memory of 2076	2992	rundll32.exe	28
PID 2992 wrote to memory of 2076	2992	rundll32.exe	28
PID 2992 wrote to memory of 2076	2992	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ccb691d1defdbb291174d4eee54687c6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ccb691d1defdbb291174d4eee54687c6.dll,#1
  2⤵
  PID:2076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads