a40e7d49005e391ac903e58c47faaaebc3f60ee85742e549dfbad9536f687e58 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
09-04-2024 22:45

Sharing

Report Analysis Logs

General

Target

671cd07564b801ebf23037e68639df13.dll
Size

6KB
MD5

671cd07564b801ebf23037e68639df13
SHA1

f5826c643b0201a36deb1e619b01e80aee8db110
SHA256

a40e7d49005e391ac903e58c47faaaebc3f60ee85742e549dfbad9536f687e58
SHA512

bbed7eef95dc754dc0783567935e63adf92a7fc536d02377bf6cf47f0859a6acab40b645d7e57140ea67c38031d6a006c0ec7de4f02736d0c6f4619ae0d80d3d
SSDEEP

48:63mll5YVOa9VUX1iwbQWu0vB+BDq9J5SH:VDa9VUX9bQWPB+FqX5SH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 1920	1600	rundll32.exe	28
PID 1600 wrote to memory of 1920	1600	rundll32.exe	28
PID 1600 wrote to memory of 1920	1600	rundll32.exe	28
PID 1600 wrote to memory of 1920	1600	rundll32.exe	28
PID 1600 wrote to memory of 1920	1600	rundll32.exe	28
PID 1600 wrote to memory of 1920	1600	rundll32.exe	28
PID 1600 wrote to memory of 1920	1600	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\671cd07564b801ebf23037e68639df13.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\671cd07564b801ebf23037e68639df13.dll,#1
  2⤵
  PID:1920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads