5f28a38bbb33f2a804da59c7945646792932b9eca679e14a1d0d996e5a0b95f3 | Triage

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 21:44

Sharing

Report Analysis Logs

General

Target

e029e163529a4956096822c95b1d6c88.dll
Size

44KB
MD5

e029e163529a4956096822c95b1d6c88
SHA1

69a7375ca00e519c6eaa60ec08bd369160db9f6a
SHA256

5f28a38bbb33f2a804da59c7945646792932b9eca679e14a1d0d996e5a0b95f3
SHA512

4ed594ccff8a2dc994320ebc4ff244014150d74fe7b84429b262349b7a02ecf2f56771882bc0f37efe939197eace0324041aabe1555e8fbe61ec683b307b0f9d
SSDEEP

768:7pZPhi3sSzKdSrxNgZVCld8L7Nyv0IdXA:7pZPhTh8xNgZVCIFIdX

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1696	1652	rundll32.exe	28
PID 1652 wrote to memory of 1696	1652	rundll32.exe	28
PID 1652 wrote to memory of 1696	1652	rundll32.exe	28
PID 1652 wrote to memory of 1696	1652	rundll32.exe	28
PID 1652 wrote to memory of 1696	1652	rundll32.exe	28
PID 1652 wrote to memory of 1696	1652	rundll32.exe	28
PID 1652 wrote to memory of 1696	1652	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e029e163529a4956096822c95b1d6c88.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e029e163529a4956096822c95b1d6c88.dll,#1
  2⤵
  PID:1696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads