6911f594c39c1be2db6b9a963c7d51b81f762a95c65542a13207d9354bc1ca00 | Triage

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-04-2024 05:30

Sharing

Report Analysis Logs

General

Target

09a7282df38853c3f6018637200a3aee.dll
Size

6KB
MD5

09a7282df38853c3f6018637200a3aee
SHA1

57c7c7be35097675185991ca0bd08d7c68e3361f
SHA256

6911f594c39c1be2db6b9a963c7d51b81f762a95c65542a13207d9354bc1ca00
SHA512

b620240d4338445b9bda6da241d0b9f9adbb1cfb3ef66e454eeeb6ac20041ddbfc15f8f51ad8abccf622407a8b0e186127e85e874eca84a7920af833e4c95aab
SSDEEP

48:6DOdd5YVOiFVE/y/sqwokyJyi04B+BDq9J5S9:piFVE/y6okJkB+FqX5S9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2996	2980	rundll32.exe	28
PID 2980 wrote to memory of 2996	2980	rundll32.exe	28
PID 2980 wrote to memory of 2996	2980	rundll32.exe	28
PID 2980 wrote to memory of 2996	2980	rundll32.exe	28
PID 2980 wrote to memory of 2996	2980	rundll32.exe	28
PID 2980 wrote to memory of 2996	2980	rundll32.exe	28
PID 2980 wrote to memory of 2996	2980	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\09a7282df38853c3f6018637200a3aee.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\09a7282df38853c3f6018637200a3aee.dll,#1
  2⤵
  PID:2996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads