a8c4320d68b31d73ae042891396e9ab3d6c13c793a64dee14da56a05e541c815 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
10-04-2024 05:52

Sharing

Report Analysis Logs

General

Target

2cfe33ab7dbf1517c9bc17461da7dab3.dll
Size

3KB
MD5

2cfe33ab7dbf1517c9bc17461da7dab3
SHA1

ea83868ac1b858627a139b1913f01f9dc5e8d11e
SHA256

a8c4320d68b31d73ae042891396e9ab3d6c13c793a64dee14da56a05e541c815
SHA512

579517c415336b4ebd6298c48df7e0da29faae0d61e10870bc00147b8bb54bf8f4af0d83e1c83495a3e069f97f18075ea6ca640a82ff1e3a277a5d153fd84c9a

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2200	2356	rundll32.exe	28
PID 2356 wrote to memory of 2200	2356	rundll32.exe	28
PID 2356 wrote to memory of 2200	2356	rundll32.exe	28
PID 2356 wrote to memory of 2200	2356	rundll32.exe	28
PID 2356 wrote to memory of 2200	2356	rundll32.exe	28
PID 2356 wrote to memory of 2200	2356	rundll32.exe	28
PID 2356 wrote to memory of 2200	2356	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cfe33ab7dbf1517c9bc17461da7dab3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2cfe33ab7dbf1517c9bc17461da7dab3.dll,#1
  2⤵
  PID:2200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads