4b7abdcb2c958a551b20d87025adb7bcb12ab3fe5f063c5b10461c775e7aab8b | Triage

Analysis

max time kernel
70s
max time network
27s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 19:11 UTC

Sharing

Report Analysis Logs

General

Target

Samples/VC/Cli_AP.dll
Size

196KB
MD5

29feb5f8046ff3d3c8d68a27da2ea5cb
SHA1

a4cf45d89819dc9e8a3d0fa7f97ee51be3017314
SHA256

429778464bd0211a808d95d8dd3bb5fb49226aaf93061c67f211cbcc7c04f444
SHA512

7b70e7d66001edfe65de3910e6af1cb6491934b8e843ed30397880fafc4c6faa8f59a98537c58ab08e43db08b2430efdc09283de24e886fc7e1fa55a0a54f2a0
SSDEEP

3072:i/ucoihhiw18ZOu5xbfNYoW8T5LLIJUlU:iKiyc8Zj5Sd

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 2352	1896	rundll32.exe	29
PID 1896 wrote to memory of 2352	1896	rundll32.exe	29
PID 1896 wrote to memory of 2352	1896	rundll32.exe	29
PID 1896 wrote to memory of 2352	1896	rundll32.exe	29
PID 1896 wrote to memory of 2352	1896	rundll32.exe	29
PID 1896 wrote to memory of 2352	1896	rundll32.exe	29
PID 1896 wrote to memory of 2352	1896	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Samples\VC\Cli_AP.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Samples\VC\Cli_AP.dll,#1
  2⤵
  PID:2352

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads