5998bb24fa4422e2dc59cdda86949d398f3f81fcc5cc68b9066c1d1965ffe1da | Triage

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 09:39

Sharing

Report Analysis Logs

General

Target

ded9e22ae0834ae7bf0c398db4d1ffb2.dll
Size

34KB
MD5

ded9e22ae0834ae7bf0c398db4d1ffb2
SHA1

637c88c7e20a9100bcb146154ee77d4f6d6e5169
SHA256

5998bb24fa4422e2dc59cdda86949d398f3f81fcc5cc68b9066c1d1965ffe1da
SHA512

23b0463698adc95c192bea6583148ddaf7d17a66362110d7c60b55408d381e51890ee27f1148e23a9c6113949e4821910d7d6ccea7936362bcc186c0a6c59cb1
SSDEEP

768:6a8lahZqQdUpHvEPp6w7p/ANZm2OVORi838X5:6a8cOpH8hb7p/AbfRw

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 2876	1108	rundll32.exe	28
PID 1108 wrote to memory of 2876	1108	rundll32.exe	28
PID 1108 wrote to memory of 2876	1108	rundll32.exe	28
PID 1108 wrote to memory of 2876	1108	rundll32.exe	28
PID 1108 wrote to memory of 2876	1108	rundll32.exe	28
PID 1108 wrote to memory of 2876	1108	rundll32.exe	28
PID 1108 wrote to memory of 2876	1108	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ded9e22ae0834ae7bf0c398db4d1ffb2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ded9e22ae0834ae7bf0c398db4d1ffb2.dll,#1
  2⤵
  PID:2876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads