cf0390fce2622ca649704463c1a7840007f85ac456c7b30143ce2be69c859194 | Triage

Analysis

max time kernel
0s
max time network
3s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-03-2024 13:19

Sharing

Report Analysis Logs

General

Target

d6371501796b46be1046c13f7fa17f95.dll
Size

88KB
MD5

d6371501796b46be1046c13f7fa17f95
SHA1

afeebf99e0c11fdcf9828b42ee77ab909e2b3c77
SHA256

cf0390fce2622ca649704463c1a7840007f85ac456c7b30143ce2be69c859194
SHA512

5c98793ca62307016d6bb40ffae59f62b32b0ff7e2857cc6aa02325c392eb15c9ac2ea45a15b38e05156cd81b0c200cd31450340af01bcf9e397792f4c7b4a33
SSDEEP

1536:SicjQWlBGmCj3CA1rPFW122smkjTP0z2eWLnhK6ba:SicjQwB2jPrPrT8yeSva

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 2232	1864	rundll32.exe	28
PID 1864 wrote to memory of 2232	1864	rundll32.exe	28
PID 1864 wrote to memory of 2232	1864	rundll32.exe	28
PID 1864 wrote to memory of 2232	1864	rundll32.exe	28
PID 1864 wrote to memory of 2232	1864	rundll32.exe	28
PID 1864 wrote to memory of 2232	1864	rundll32.exe	28
PID 1864 wrote to memory of 2232	1864	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d6371501796b46be1046c13f7fa17f95.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d6371501796b46be1046c13f7fa17f95.dll,#1
  2⤵
  PID:2232

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads