8ee15f871bbb300d5507431734e4d71952a2ea74dd68ff3daac6a49579546e41 | Triage

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/03/2024, 11:06

Sharing

Report Analysis Logs

General

Target

d359879142a453f7a72cae321428a462.dll
Size

69KB
MD5

d359879142a453f7a72cae321428a462
SHA1

94fa29fb0939b26d1a7e70b095798db16fc0e695
SHA256

8ee15f871bbb300d5507431734e4d71952a2ea74dd68ff3daac6a49579546e41
SHA512

beb42ac8b6aaa779b2a1b672742f9f1d252922b74179715d3d02e3aa64e1213bfeaecdddfb8dc1ba194d546e76efbf61cba4ce3d55998accc609668d114de4c3
SSDEEP

1536:E+PrTlpsup7LOpRvZ2RB+PrTlpsup7LOpRvZ2RY:EA5QFkLA5QFky

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 1740	1908	rundll32.exe	28
PID 1908 wrote to memory of 1740	1908	rundll32.exe	28
PID 1908 wrote to memory of 1740	1908	rundll32.exe	28
PID 1908 wrote to memory of 1740	1908	rundll32.exe	28
PID 1908 wrote to memory of 1740	1908	rundll32.exe	28
PID 1908 wrote to memory of 1740	1908	rundll32.exe	28
PID 1908 wrote to memory of 1740	1908	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d359879142a453f7a72cae321428a462.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d359879142a453f7a72cae321428a462.dll,#1
  2⤵
  PID:1740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads