9cc2a6c640288355ca462ec468b1b8a31962d7dd186d1dbd5c5039d54f177fb9 | Triage

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-04-2024 05:52

Sharing

Report Analysis Logs

General

Target

2d30b3fb87ca3cf64e315e676628890e.dll
Size

6KB
MD5

2d30b3fb87ca3cf64e315e676628890e
SHA1

04226673d4822d4c185e889e431c141970fe2f1d
SHA256

9cc2a6c640288355ca462ec468b1b8a31962d7dd186d1dbd5c5039d54f177fb9
SHA512

1fcf0976768a47a5d4dd4a0cca0aea00cfbdd3fe0a9d956e12a90a737bfd506ce7be210a50e63aef899ac8e05fc522ca49b8f9f46007aed84d495be83e831a95
SSDEEP

48:6WQV5YVOqtV0H1pw9ygYVUG0MOB+BDq9J5SC:8qtV0HAr4CB+FqX5SC

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 2028	812	rundll32.exe	28
PID 812 wrote to memory of 2028	812	rundll32.exe	28
PID 812 wrote to memory of 2028	812	rundll32.exe	28
PID 812 wrote to memory of 2028	812	rundll32.exe	28
PID 812 wrote to memory of 2028	812	rundll32.exe	28
PID 812 wrote to memory of 2028	812	rundll32.exe	28
PID 812 wrote to memory of 2028	812	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d30b3fb87ca3cf64e315e676628890e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2d30b3fb87ca3cf64e315e676628890e.dll,#1
  2⤵
  PID:2028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads