de61d876600999905d87b04fc298b77d0db79094f57774796f8175a1d9bbe1b7 | Triage

Analysis

max time kernel
20s
max time network
28s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 23:30

Sharing

Report Analysis Logs

General

Target

d18725fb66d14ca123f3b9ace601271e.dll
Size

6KB
MD5

d18725fb66d14ca123f3b9ace601271e
SHA1

1192a59ec3c80a311c90f80ded703f87b38a3b5b
SHA256

de61d876600999905d87b04fc298b77d0db79094f57774796f8175a1d9bbe1b7
SHA512

b80153065fd50751931d683a6e837b368b77cdb776a8d436140dbca8a85b82fc96138909f38e19b1a766692cbacef9c662d000daa1f264d610e5764df079c661
SSDEEP

48:63mll5YVOa9VUX1iwbQWu0FFB+BDq9J5SH:VDa9VUX9bQWlFB+FqX5SH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2604	2192	rundll32.exe	28
PID 2192 wrote to memory of 2604	2192	rundll32.exe	28
PID 2192 wrote to memory of 2604	2192	rundll32.exe	28
PID 2192 wrote to memory of 2604	2192	rundll32.exe	28
PID 2192 wrote to memory of 2604	2192	rundll32.exe	28
PID 2192 wrote to memory of 2604	2192	rundll32.exe	28
PID 2192 wrote to memory of 2604	2192	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d18725fb66d14ca123f3b9ace601271e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d18725fb66d14ca123f3b9ace601271e.dll,#1
  2⤵
  PID:2604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads