d8f55a97c693ef6beb6317f6809da86d00d3dc9e45c5007b188f46f6c055ec90 | Triage

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18-04-2024 03:13

Sharing

Report Analysis Logs

General

Target

d8f55a97c693ef6beb6317f6809da86d00d3dc9e45c5007b188f46f6c055ec90.dll
Size

3KB
MD5

9e477f6cdfbd8894a29766e84ed91310
SHA1

ab2aae99b44bc7f54ae0c754ff9e88dc91fb9ba0
SHA256

d8f55a97c693ef6beb6317f6809da86d00d3dc9e45c5007b188f46f6c055ec90
SHA512

5f58175f49797e97a44684f205e33d62c11f8becd9a91385df6d5e0320a24466942c25d99d08f9a0cb02f7bff892c1581e21ae42ce35ec2a7094a6c00854601e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2800	2764	rundll32.exe	28
PID 2764 wrote to memory of 2800	2764	rundll32.exe	28
PID 2764 wrote to memory of 2800	2764	rundll32.exe	28
PID 2764 wrote to memory of 2800	2764	rundll32.exe	28
PID 2764 wrote to memory of 2800	2764	rundll32.exe	28
PID 2764 wrote to memory of 2800	2764	rundll32.exe	28
PID 2764 wrote to memory of 2800	2764	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d8f55a97c693ef6beb6317f6809da86d00d3dc9e45c5007b188f46f6c055ec90.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d8f55a97c693ef6beb6317f6809da86d00d3dc9e45c5007b188f46f6c055ec90.dll,#1
  2⤵
  PID:2800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads