39a98fcd0f69e0aef96d80162e13ddd3c6a875e906a8b3a3ffb3c3a1b2a2782e | Triage

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 23:11

Sharing

Report Analysis Logs

General

Target

a9f0c322e8c41895672cc007842953d8.dll
Size

7KB
MD5

a9f0c322e8c41895672cc007842953d8
SHA1

1755f96bddb556a0baf25111930e3a3a9eb93552
SHA256

39a98fcd0f69e0aef96d80162e13ddd3c6a875e906a8b3a3ffb3c3a1b2a2782e
SHA512

bd28097c355d698fb1a35bb4535308814ede33f33fffc7ced2392d2947da1b26ba45da8ff71584f8ad707fa31adf4b794f99a09806a766658e6baf88dca3a9ac
SSDEEP

96:wb4VHccYJUC/aFbz/j0OvaPgd3cX5aXW:wUaJf/aFbP0O32JaX

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 1756	3012	rundll32.exe	28
PID 3012 wrote to memory of 1756	3012	rundll32.exe	28
PID 3012 wrote to memory of 1756	3012	rundll32.exe	28
PID 3012 wrote to memory of 1756	3012	rundll32.exe	28
PID 3012 wrote to memory of 1756	3012	rundll32.exe	28
PID 3012 wrote to memory of 1756	3012	rundll32.exe	28
PID 3012 wrote to memory of 1756	3012	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9f0c322e8c41895672cc007842953d8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9f0c322e8c41895672cc007842953d8.dll,#1
  2⤵
  PID:1756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads