3d90fedb0d6e665b0e0c3cf4811c90bd3a496d08d3b5d77ba36cbc0e02be212f | Triage

Analysis

max time kernel
121s
max time network
164s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-04-2024 23:38

Sharing

Report Analysis Logs

General

Target

fc3289d2aba7898c76d63309c0f20993.dll
Size

6KB
MD5

fc3289d2aba7898c76d63309c0f20993
SHA1

9d7c69594d1a3af3dee235e23a974111bc1382aa
SHA256

3d90fedb0d6e665b0e0c3cf4811c90bd3a496d08d3b5d77ba36cbc0e02be212f
SHA512

a57d943542f15e6c1e3688bf7f21c7e90ac8a799be79d92d1f78f59c87b56f815a9cebc1330986334a86af46196f3c353ccc5a3bcb7c43419ff5af0ee85171e0
SSDEEP

48:6WQV5YVOqtV0H1pw9ygYVUG0SB+BDq9J5SC:8qtV0HAr4bB+FqX5SC

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 1976	2552	rundll32.exe	29
PID 2552 wrote to memory of 1976	2552	rundll32.exe	29
PID 2552 wrote to memory of 1976	2552	rundll32.exe	29
PID 2552 wrote to memory of 1976	2552	rundll32.exe	29
PID 2552 wrote to memory of 1976	2552	rundll32.exe	29
PID 2552 wrote to memory of 1976	2552	rundll32.exe	29
PID 2552 wrote to memory of 1976	2552	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc3289d2aba7898c76d63309c0f20993.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc3289d2aba7898c76d63309c0f20993.dll,#1
  2⤵
  PID:1976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads