360f8e669f59d7484dc6019b4fdb9b39f33dbb3e95dec06fe8aed1f846f4a9d0 | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-04-2024 19:24

Sharing

Report Analysis Logs

General

Target

382d31dbf4631ea3f1e668016d930425.dll
Size

6KB
MD5

382d31dbf4631ea3f1e668016d930425
SHA1

56235832b1a5dc8603c9c37fa55a18135adbc142
SHA256

360f8e669f59d7484dc6019b4fdb9b39f33dbb3e95dec06fe8aed1f846f4a9d0
SHA512

ebc8129cc92e621216363f1a5bcf455728c85fa9253adc6a6083f8c31b56dca5888b1ed6288f131d093798337eb2ab850dbbe864c626ba9eb78e60801356b0e1
SSDEEP

96:hy859x0P8MaXRRj766tOcC91+10UNffs11Np:F5oL+76IgI/ffe

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2212	3000	rundll32.exe	28
PID 3000 wrote to memory of 2212	3000	rundll32.exe	28
PID 3000 wrote to memory of 2212	3000	rundll32.exe	28
PID 3000 wrote to memory of 2212	3000	rundll32.exe	28
PID 3000 wrote to memory of 2212	3000	rundll32.exe	28
PID 3000 wrote to memory of 2212	3000	rundll32.exe	28
PID 3000 wrote to memory of 2212	3000	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\382d31dbf4631ea3f1e668016d930425.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\382d31dbf4631ea3f1e668016d930425.dll,#1
  2⤵
  PID:2212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads