3bebb7380c6abf4812e33288301aef099a62ba4a5f13542d253d3353e53f26a6 | Triage

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 07:20

Sharing

Report Analysis Logs

General

Target

d5883ee1954de088d8cc4a45638485cd.dll
Size

220KB
MD5

d5883ee1954de088d8cc4a45638485cd
SHA1

21bb1d43b1ed87b9e4c4b5ea72bbb121c7cd2cf2
SHA256

3bebb7380c6abf4812e33288301aef099a62ba4a5f13542d253d3353e53f26a6
SHA512

cf67b5d3a651e03d5dc01e68d39a276a13ccebf2cfc48b24265663735927a6fed2f880c523784ee29dcf0dab35097d0cc176de8356e48e0308979d44f9c5e71a
SSDEEP

768:ld4Xvua1kKQBQQyYqui2CBBQARQk4jnXEACT:H4X2aWKQJXi2CBBQARInwT

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2140	1848	rundll32.exe	28
PID 1848 wrote to memory of 2140	1848	rundll32.exe	28
PID 1848 wrote to memory of 2140	1848	rundll32.exe	28
PID 1848 wrote to memory of 2140	1848	rundll32.exe	28
PID 1848 wrote to memory of 2140	1848	rundll32.exe	28
PID 1848 wrote to memory of 2140	1848	rundll32.exe	28
PID 1848 wrote to memory of 2140	1848	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d5883ee1954de088d8cc4a45638485cd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d5883ee1954de088d8cc4a45638485cd.dll,#1
  2⤵
  PID:2140

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads