5e073aaab5aef67fc9b9c5dd851bf4bd6cb7ba08898086d6646e990d699f15dd | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 22:07

Sharing

Report Analysis Logs

General

Target

5e073aaab5aef67fc9b9c5dd851bf4bd6cb7ba08898086d6646e990d699f15dd.dll
Size

3KB
MD5

9e4e0f75d44c94587193909a1395fe12
SHA1

68e227f7869eaf1613bdc015b7e18a4e8e7f8073
SHA256

5e073aaab5aef67fc9b9c5dd851bf4bd6cb7ba08898086d6646e990d699f15dd
SHA512

594bbae8d27ed8e12871209920539349451f35c35b26c3cb6f04ca25988428952f00e79a8a0914a11a21aeed8855e2fda94f1ea049ad4039bcfd5e95a3d77e3f

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 2196	1196	rundll32.exe	28
PID 1196 wrote to memory of 2196	1196	rundll32.exe	28
PID 1196 wrote to memory of 2196	1196	rundll32.exe	28
PID 1196 wrote to memory of 2196	1196	rundll32.exe	28
PID 1196 wrote to memory of 2196	1196	rundll32.exe	28
PID 1196 wrote to memory of 2196	1196	rundll32.exe	28
PID 1196 wrote to memory of 2196	1196	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e073aaab5aef67fc9b9c5dd851bf4bd6cb7ba08898086d6646e990d699f15dd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e073aaab5aef67fc9b9c5dd851bf4bd6cb7ba08898086d6646e990d699f15dd.dll,#1
  2⤵
  PID:2196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads