58467e7d680f48e945add02dba6f8b0d099edd5fc85b4f19e3d0c29ec9831794 | Triage

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/04/2024, 21:02

Sharing

Report Analysis Logs

General

Target

58467e7d680f48e945add02dba6f8b0d099edd5fc85b4f19e3d0c29ec9831794.dll
Size

3KB
MD5

a5028da19c5c9ed1c314bb0c9305b109
SHA1

8933cf4b06fee0029815a73a98d58f9558928c62
SHA256

58467e7d680f48e945add02dba6f8b0d099edd5fc85b4f19e3d0c29ec9831794
SHA512

6a14f874a83ca6e912dadcad95fdb8517eda44dfde2520a8decaeb2da258e847aa535ab4122e4b8b982605396a5855b3db5ae0ded6f030d8de20b47e48412455

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1696	2036	rundll32.exe	28
PID 2036 wrote to memory of 1696	2036	rundll32.exe	28
PID 2036 wrote to memory of 1696	2036	rundll32.exe	28
PID 2036 wrote to memory of 1696	2036	rundll32.exe	28
PID 2036 wrote to memory of 1696	2036	rundll32.exe	28
PID 2036 wrote to memory of 1696	2036	rundll32.exe	28
PID 2036 wrote to memory of 1696	2036	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\58467e7d680f48e945add02dba6f8b0d099edd5fc85b4f19e3d0c29ec9831794.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\58467e7d680f48e945add02dba6f8b0d099edd5fc85b4f19e3d0c29ec9831794.dll,#1
  2⤵
  PID:1696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads