2f65264f93c6d71fb7d1290093ae033f264795c98545b7df9f64be6c63d46dbd | Triage

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/03/2024, 12:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ce0d5b1aaec0c408abcb7714cb4ad3cb.dll
Size

72KB
MD5

ce0d5b1aaec0c408abcb7714cb4ad3cb
SHA1

17a70d6b3372eb96730679fcffbd303b7e898102
SHA256

2f65264f93c6d71fb7d1290093ae033f264795c98545b7df9f64be6c63d46dbd
SHA512

ee45d3abebbcc834c05f1364253ade7a9484652c2cc45bf7314471bb7dc94aae1534d3ecd5896a6ce7961b399ca3e54b587ec9e0f937f6f6c22f727bba0aa22b
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuv:C5UOq0ukgOK2l7aFQv

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2024	2004	rundll32.exe	28
PID 2004 wrote to memory of 2024	2004	rundll32.exe	28
PID 2004 wrote to memory of 2024	2004	rundll32.exe	28
PID 2004 wrote to memory of 2024	2004	rundll32.exe	28
PID 2004 wrote to memory of 2024	2004	rundll32.exe	28
PID 2004 wrote to memory of 2024	2004	rundll32.exe	28
PID 2004 wrote to memory of 2024	2004	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce0d5b1aaec0c408abcb7714cb4ad3cb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce0d5b1aaec0c408abcb7714cb4ad3cb.dll,#1
  2⤵
  PID:2024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads