95bc091c9ae9dce5f3bdc4bd19c913f8d0036f28b2ad49425f410dbb81f8b568 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 22:06

Sharing

Report Analysis Logs

General

Target

342eafd8b52a409e2f432b3b8349fd88.dll
Size

6KB
MD5

342eafd8b52a409e2f432b3b8349fd88
SHA1

cb2bb654e4df16b06ff60deeda4827ac54f82fab
SHA256

95bc091c9ae9dce5f3bdc4bd19c913f8d0036f28b2ad49425f410dbb81f8b568
SHA512

d1ffe15d60e5a4d5d6be93f6b996860ee34d27fca784afef0a472aa15ade4cb23d52c97c4088bb61c61fafddd06eae9d688034fda3d518bff7e9ab438417db7e
SSDEEP

48:63mll5YVOa9VUX1iwbQWu0mB+BDq9J5SH:VDa9VUX9bQWGB+FqX5SH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2012	2364	rundll32.exe	28
PID 2364 wrote to memory of 2012	2364	rundll32.exe	28
PID 2364 wrote to memory of 2012	2364	rundll32.exe	28
PID 2364 wrote to memory of 2012	2364	rundll32.exe	28
PID 2364 wrote to memory of 2012	2364	rundll32.exe	28
PID 2364 wrote to memory of 2012	2364	rundll32.exe	28
PID 2364 wrote to memory of 2012	2364	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\342eafd8b52a409e2f432b3b8349fd88.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\342eafd8b52a409e2f432b3b8349fd88.dll,#1
  2⤵
  PID:2012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads