4c8d4bf01b1a65e0eb0208ca22c483f640c1646622572146b5a8a9010e59abc8 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
16/03/2024, 02:15

Sharing

Report Analysis Logs

General

Target

ccdaf077a2d66655602e9dda07568c2b.dll
Size

7KB
MD5

ccdaf077a2d66655602e9dda07568c2b
SHA1

8b677fa0dcaab3d404687719a332804c642b6040
SHA256

4c8d4bf01b1a65e0eb0208ca22c483f640c1646622572146b5a8a9010e59abc8
SHA512

1bc18f5c3da21b1bb247a352928fb1ba6ff25e3d44a19c510e8d3c58582ff7d8d18ad74a20227f3bf0acdcdc810343f8e9d61535b32360fa1d4d377ea4b1c883
SSDEEP

96:wb4VHccYJUC/aFbz/j0OvaPvd3cX5aXW:wUaJf/aFbP0OI2JaX

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1984	1992	rundll32.exe	28
PID 1992 wrote to memory of 1984	1992	rundll32.exe	28
PID 1992 wrote to memory of 1984	1992	rundll32.exe	28
PID 1992 wrote to memory of 1984	1992	rundll32.exe	28
PID 1992 wrote to memory of 1984	1992	rundll32.exe	28
PID 1992 wrote to memory of 1984	1992	rundll32.exe	28
PID 1992 wrote to memory of 1984	1992	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ccdaf077a2d66655602e9dda07568c2b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ccdaf077a2d66655602e9dda07568c2b.dll,#1
  2⤵
  PID:1984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads