8532da01f9d0b985bb8033122f133cff7d76b7c9bbd607efc015affdc2a03876 | Triage

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 23:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a7f784098e0328f9065811984b5f73e4.dll
Size

6KB
MD5

a7f784098e0328f9065811984b5f73e4
SHA1

81a9fda19d6db3450a08cf0423578acb5d87e15e
SHA256

8532da01f9d0b985bb8033122f133cff7d76b7c9bbd607efc015affdc2a03876
SHA512

90688f0e6a5046120724f06b94802de27bbee56e1329989a6c49815202f46dbb47cc53575eb04586a6c7dd7d44cc57f49187f14c138355dc96040523c4ee9b7a
SSDEEP

48:6WQV5YVOqtV0H1pw9ygYVUG0MB+BDq9J5SC:8qtV0HAr4VB+FqX5SC

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2504	2164	rundll32.exe	28
PID 2164 wrote to memory of 2504	2164	rundll32.exe	28
PID 2164 wrote to memory of 2504	2164	rundll32.exe	28
PID 2164 wrote to memory of 2504	2164	rundll32.exe	28
PID 2164 wrote to memory of 2504	2164	rundll32.exe	28
PID 2164 wrote to memory of 2504	2164	rundll32.exe	28
PID 2164 wrote to memory of 2504	2164	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a7f784098e0328f9065811984b5f73e4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a7f784098e0328f9065811984b5f73e4.dll,#1
  2⤵
  PID:2504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads