5b53e7706ef6e73d286d9ffa4905caa8a340479372146ff730496edbe763c11e | Triage

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 21:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0c0dd426dc6dc59d7e5a5ab07fe6b986.dll
Size

6KB
MD5

0c0dd426dc6dc59d7e5a5ab07fe6b986
SHA1

a6d1b0ecfd34f1a6166b355b55f7f63980243d14
SHA256

5b53e7706ef6e73d286d9ffa4905caa8a340479372146ff730496edbe763c11e
SHA512

99bc544e3089bb1cc1c44d074016076c654fc74d5dff8438382e5bdda0a7aff31a8cae1b34571f556bfc5f3df8d855648a73a01643be42e43544a50e4fa1bad9
SSDEEP

48:63mll5YVOa9VUX1iwbQWu0fB+BDq9J5SH:VDa9VUX9bQW/B+FqX5SH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 1908	1904	rundll32.exe	28
PID 1904 wrote to memory of 1908	1904	rundll32.exe	28
PID 1904 wrote to memory of 1908	1904	rundll32.exe	28
PID 1904 wrote to memory of 1908	1904	rundll32.exe	28
PID 1904 wrote to memory of 1908	1904	rundll32.exe	28
PID 1904 wrote to memory of 1908	1904	rundll32.exe	28
PID 1904 wrote to memory of 1908	1904	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c0dd426dc6dc59d7e5a5ab07fe6b986.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c0dd426dc6dc59d7e5a5ab07fe6b986.dll,#1
  2⤵
  PID:1908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads