6f26fca83c45a7320ebbe45cd4ddca7d11bafd5e70e150d97b84c94db06ef064 | Triage

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 22:41

Sharing

Report Analysis Logs

General

Target

5d2216e22baec8aa7531f32a9cfbeccc.dll
Size

6KB
MD5

5d2216e22baec8aa7531f32a9cfbeccc
SHA1

09980870f2aea8aecf7cdff4b75a22c015dd5c20
SHA256

6f26fca83c45a7320ebbe45cd4ddca7d11bafd5e70e150d97b84c94db06ef064
SHA512

e6f15ddc39808d056012e018a63a3a42b485db23527708d3b8472ffc6e04c22a00d94513dfde3160ccfa53276179edd52ce9dff27e6a64fd7e21be4476f769f1
SSDEEP

48:6AA35YVOQDV8FszwydlAYsLFV3G0Y2B+BDq9J5S2:0QDV8FscMjsLFV3vB+FqX5S2

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2904	2888	rundll32.exe	28
PID 2888 wrote to memory of 2904	2888	rundll32.exe	28
PID 2888 wrote to memory of 2904	2888	rundll32.exe	28
PID 2888 wrote to memory of 2904	2888	rundll32.exe	28
PID 2888 wrote to memory of 2904	2888	rundll32.exe	28
PID 2888 wrote to memory of 2904	2888	rundll32.exe	28
PID 2888 wrote to memory of 2904	2888	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5d2216e22baec8aa7531f32a9cfbeccc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5d2216e22baec8aa7531f32a9cfbeccc.dll,#1
  2⤵
  PID:2904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads