fb7654ccc344bc315476ac691076e2a178fbb03b69de3a8f97f73c47dddf9e0b | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 22:34

Sharing

Report Analysis Logs

General

Target

50107b428b74a8902185ba4f59aa90e7.dll
Size

6KB
MD5

50107b428b74a8902185ba4f59aa90e7
SHA1

2959740e7e3b28c89db493110484c215ce6bd19f
SHA256

fb7654ccc344bc315476ac691076e2a178fbb03b69de3a8f97f73c47dddf9e0b
SHA512

cb3971f9b6138596d3719511e8bd7e0a9097c0133ea41466f311c288030f41842979ee44fff1ed717cb19c41bd73e63cef10a2f4351274599e4e033d74e41219
SSDEEP

48:6AA35YVOQDV8FszwydlAYsLFV3G0+B+BDq9J5S2:0QDV8FscMjsLFV3GB+FqX5S2

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 1512	2108	rundll32.exe	28
PID 2108 wrote to memory of 1512	2108	rundll32.exe	28
PID 2108 wrote to memory of 1512	2108	rundll32.exe	28
PID 2108 wrote to memory of 1512	2108	rundll32.exe	28
PID 2108 wrote to memory of 1512	2108	rundll32.exe	28
PID 2108 wrote to memory of 1512	2108	rundll32.exe	28
PID 2108 wrote to memory of 1512	2108	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\50107b428b74a8902185ba4f59aa90e7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\50107b428b74a8902185ba4f59aa90e7.dll,#1
  2⤵
  PID:1512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads