50b7e18d33918759a4fa88d0d317de75601d37ffad6d1e4fa86e6e6f0e113767 | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-04-2024 23:34

Sharing

Report Analysis Logs

General

Target

dad98408116d0d079d8185f93e393132.dll
Size

6KB
MD5

dad98408116d0d079d8185f93e393132
SHA1

1de3365958aff9bdf4a5a4f64774004a96225188
SHA256

50b7e18d33918759a4fa88d0d317de75601d37ffad6d1e4fa86e6e6f0e113767
SHA512

29107c9bf04eaf56964d3f40ee3c982cf013a9621a053c23147e67355a7a9d6b482918738f3c9d9853a9e7120c545dcba526d7065a3973092ee8a61186f0cd85
SSDEEP

48:6AA35YVOQDV8FszwydlAYsLFV3G0tB+BDq9J5S2:0QDV8FscMjsLFV3VB+FqX5S2

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2240	2216	rundll32.exe	28
PID 2216 wrote to memory of 2240	2216	rundll32.exe	28
PID 2216 wrote to memory of 2240	2216	rundll32.exe	28
PID 2216 wrote to memory of 2240	2216	rundll32.exe	28
PID 2216 wrote to memory of 2240	2216	rundll32.exe	28
PID 2216 wrote to memory of 2240	2216	rundll32.exe	28
PID 2216 wrote to memory of 2240	2216	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dad98408116d0d079d8185f93e393132.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dad98408116d0d079d8185f93e393132.dll,#1
  2⤵
  PID:2240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads