639b3bd6ef84cf876cd37b0724466ef155e579a5dc9d45c19fcf2611afa892e5 | Triage

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 22:52

Sharing

Report Analysis Logs

General

Target

796abbb12cb16b4bae383817ca16cd41.dll
Size

6KB
MD5

796abbb12cb16b4bae383817ca16cd41
SHA1

7a1972cf2bebabefb82acce1cdf8a21ea81224c1
SHA256

639b3bd6ef84cf876cd37b0724466ef155e579a5dc9d45c19fcf2611afa892e5
SHA512

977eb1b5b1929fac6416588ac3056f0c9fd1848f9772d4f1292c8dcaee0707ca028aa677ef21c887fb59c5f556d312d3ca6ca0ee0e21c24aacebdb04bb0f9792
SSDEEP

48:6amN5YVOy1VEvy/dw25M+e0EB+BDq9J5SzXH:Wy1VEvayP+UB+FqX5SzX

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2300	1708	rundll32.exe	28
PID 1708 wrote to memory of 2300	1708	rundll32.exe	28
PID 1708 wrote to memory of 2300	1708	rundll32.exe	28
PID 1708 wrote to memory of 2300	1708	rundll32.exe	28
PID 1708 wrote to memory of 2300	1708	rundll32.exe	28
PID 1708 wrote to memory of 2300	1708	rundll32.exe	28
PID 1708 wrote to memory of 2300	1708	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\796abbb12cb16b4bae383817ca16cd41.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\796abbb12cb16b4bae383817ca16cd41.dll,#1
  2⤵
  PID:2300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads