0c255d21bacb5c875a30dfc78fc37509045727e61ac39fd1cfa3fed00e43c412 | Triage

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-04-2024 19:52

Sharing

Report Analysis Logs

General

Target

79be5b37d33fac5ed2ec283d1260d4d4.dll
Size

3KB
MD5

79be5b37d33fac5ed2ec283d1260d4d4
SHA1

8992f088f85f1ca912818492ac6762bbbd6d3fb5
SHA256

0c255d21bacb5c875a30dfc78fc37509045727e61ac39fd1cfa3fed00e43c412
SHA512

260c22eee8ff4f79ebc242ae84fb7f4863ed5fd30b870b501da026d960c9c9f06639dab684784237d9a1318760267f783ca438127b5eaa5c2f47b77e8c3bb12a

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 2956	3036	rundll32.exe	28
PID 3036 wrote to memory of 2956	3036	rundll32.exe	28
PID 3036 wrote to memory of 2956	3036	rundll32.exe	28
PID 3036 wrote to memory of 2956	3036	rundll32.exe	28
PID 3036 wrote to memory of 2956	3036	rundll32.exe	28
PID 3036 wrote to memory of 2956	3036	rundll32.exe	28
PID 3036 wrote to memory of 2956	3036	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\79be5b37d33fac5ed2ec283d1260d4d4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\79be5b37d33fac5ed2ec283d1260d4d4.dll,#1
  2⤵
  PID:2956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads