815c5c516d54597fab23cb20fa2fe3afacdd699d89a8db6fc0027577f314007b | Triage

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-04-2024 23:39

Sharing

Report Analysis Logs

General

Target

ffb474ca0cafc5e8855d91763b4d923c.dll
Size

7KB
MD5

ffb474ca0cafc5e8855d91763b4d923c
SHA1

abec3ae1a1479045c2c6655ddbf7cac204b45041
SHA256

815c5c516d54597fab23cb20fa2fe3afacdd699d89a8db6fc0027577f314007b
SHA512

d9545822fff399eea67fd9b406c9ef7c49fb95af1415686edb02967f4e6858e9f5ce0def92443ccfb1dc1e6caa9df2249239bfae004bc3c7e8bfb431360861ea
SSDEEP

96:wb4VHccYJUC/aFbz/j0OvaPVd3cX5aXW:wUaJf/aFbP0Oi2JaX

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2020	2212	rundll32.exe	28
PID 2212 wrote to memory of 2020	2212	rundll32.exe	28
PID 2212 wrote to memory of 2020	2212	rundll32.exe	28
PID 2212 wrote to memory of 2020	2212	rundll32.exe	28
PID 2212 wrote to memory of 2020	2212	rundll32.exe	28
PID 2212 wrote to memory of 2020	2212	rundll32.exe	28
PID 2212 wrote to memory of 2020	2212	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffb474ca0cafc5e8855d91763b4d923c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffb474ca0cafc5e8855d91763b4d923c.dll,#1
  2⤵
  PID:2020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads