0b320a4ae8ad0e215c3556b09450620ed5dd41d330f748def2da037e884626d2 | Triage

Analysis

max time kernel
119s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/04/2024, 18:25

Sharing

Report Analysis Logs

General

Target

0b320a4ae8ad0e215c3556b09450620ed5dd41d330f748def2da037e884626d2.dll
Size

3KB
MD5

4c3bc8eefe56deb28782ef9958140aa5
SHA1

f6fde6997ca0dd0493e0f1d8780056652e89e1b7
SHA256

0b320a4ae8ad0e215c3556b09450620ed5dd41d330f748def2da037e884626d2
SHA512

d3b681324c3cb5dc4d09efcf446b416f47f9ed764e5d050a42f87225820317bd1a434c371ae9435272d442e83325d70dbc0822e6a8ffbc33cb5d606210b877bc

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2204	1976	rundll32.exe	28
PID 1976 wrote to memory of 2204	1976	rundll32.exe	28
PID 1976 wrote to memory of 2204	1976	rundll32.exe	28
PID 1976 wrote to memory of 2204	1976	rundll32.exe	28
PID 1976 wrote to memory of 2204	1976	rundll32.exe	28
PID 1976 wrote to memory of 2204	1976	rundll32.exe	28
PID 1976 wrote to memory of 2204	1976	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b320a4ae8ad0e215c3556b09450620ed5dd41d330f748def2da037e884626d2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0b320a4ae8ad0e215c3556b09450620ed5dd41d330f748def2da037e884626d2.dll,#1
  2⤵
  PID:2204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads