fcfcea85a15e4cfeb120fb025974a9c3c115bba77f1ed860782861bec4e0b926 | Triage

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-04-2024 19:38

Sharing

Report Analysis Logs

General

Target

DMSharedClasses.dll
Size

56KB
MD5

4780093749d2f056143b802ccd980228
SHA1

1029a2c3e2a549103d8e9d63b5ab338afd9b819c
SHA256

e4d69b5e90056c2cd861703514b6cee5a684784aaf797689e3fadc3f49b11f49
SHA512

a32a8bd68976d2b5b89311e85674db3a46edc32cf2432ed4a765d81846ff42bc8126d3e8c990770d64f582a54552cbfb302f8873edd51110a883ac0a899f1e01
SSDEEP

1536:pm9fs+I6dH5DTNA2FFQRus7Zpe+P4uwm:pilI6dH5DW2pslIm

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3024 wrote to memory of 1996	3024	rundll32.exe	rundll32.exe
PID 3024 wrote to memory of 1996	3024	rundll32.exe	rundll32.exe
PID 3024 wrote to memory of 1996	3024	rundll32.exe	rundll32.exe
PID 3024 wrote to memory of 1996	3024	rundll32.exe	rundll32.exe
PID 3024 wrote to memory of 1996	3024	rundll32.exe	rundll32.exe
PID 3024 wrote to memory of 1996	3024	rundll32.exe	rundll32.exe
PID 3024 wrote to memory of 1996	3024	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DMSharedClasses.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3024

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DMSharedClasses.dll,#1
2⤵
PID:1996

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...