ce816088598bb98b6556479af9801fcfe8d817f18cc4b8ef12cf109310fa078f | Triage

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-03-2024 14:56

Sharing

Report Analysis Logs

General

Target

e1f0dba5bac1f1d4bb376e82232a2808.dll
Size

66KB
MD5

e1f0dba5bac1f1d4bb376e82232a2808
SHA1

b98040734bddc8b6412a7da132bdae4572fb7a5a
SHA256

ce816088598bb98b6556479af9801fcfe8d817f18cc4b8ef12cf109310fa078f
SHA512

a7ba2c0e4e290eb958f68e9ecf32e35ec809e45d112f05f423f1d290e8ae54696da923c74993d6a8c0d462c80938e7c1a457ad7d888ab54e48ed8b24d36960ef
SSDEEP

1536:NmWiB5tbTXIqM5w4tGq8g58KVL20u78+ZHZTl:oWctv8w4tGoruHZ/

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 2952	1668	rundll32.exe	28
PID 1668 wrote to memory of 2952	1668	rundll32.exe	28
PID 1668 wrote to memory of 2952	1668	rundll32.exe	28
PID 1668 wrote to memory of 2952	1668	rundll32.exe	28
PID 1668 wrote to memory of 2952	1668	rundll32.exe	28
PID 1668 wrote to memory of 2952	1668	rundll32.exe	28
PID 1668 wrote to memory of 2952	1668	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e1f0dba5bac1f1d4bb376e82232a2808.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e1f0dba5bac1f1d4bb376e82232a2808.dll,#1
  2⤵
  PID:2952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2952-0-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/2952-1-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download