874d8ab5a095ffcb98786ae85160edc3dfb9eadadb98858e54d55578eea8473f | Triage

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-04-2024 22:28

Sharing

Report Analysis Logs

General

Target

4947572113837e137504a67ae27068e6.dll
Size

7KB
MD5

4947572113837e137504a67ae27068e6
SHA1

b3f9d4c66c6521eadd62b5e8a23ee9ee68fee197
SHA256

874d8ab5a095ffcb98786ae85160edc3dfb9eadadb98858e54d55578eea8473f
SHA512

0df75c06169c2d02b68f8937a23916db35d3e60c59849872a66c440d4dffa1f3ccad5754824a6c06803bcb4e5b2a728d26649835a1e1a1892f97a6ef304dd833
SSDEEP

96:wb4VHccYJUC/aFbz/j0OvaPcd3cX5aXW:wUaJf/aFbP0OH2JaX

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2696	2036	rundll32.exe	28
PID 2036 wrote to memory of 2696	2036	rundll32.exe	28
PID 2036 wrote to memory of 2696	2036	rundll32.exe	28
PID 2036 wrote to memory of 2696	2036	rundll32.exe	28
PID 2036 wrote to memory of 2696	2036	rundll32.exe	28
PID 2036 wrote to memory of 2696	2036	rundll32.exe	28
PID 2036 wrote to memory of 2696	2036	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4947572113837e137504a67ae27068e6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4947572113837e137504a67ae27068e6.dll,#1
  2⤵
  PID:2696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads