23a66b32dfa75a94036870a1dce0bfabe6b52331eb2bed02e6953b9fead97298 | Triage

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
01-05-2024 21:13

Sharing

Report Analysis Logs

General

Target

System.Data.Common.dll
Size

2.7MB
MD5

a5e6418794faf04ae4c9b7eb37e2fa52
SHA1

da08753e9e3de4ede668902a98b43a04345664c3
SHA256

9064122f6ab10928fadc2e244287d0d9ca068e0b1b9a5ed65e2fb9f71ec5c47a
SHA512

1c23dea2ff770a597043658177fb3413733e244fe38bcfbe1b673fe9aa9a47c6b082fd3b82ddc52329b5b08e3f54435d37ff6c00516b32226d25ea36de702af9
SSDEEP

49152:iJbrz83SifrRXbuoYTw6Xr4Kdd/ebiBoHtk069gN4srA1:2rzn7sHg93sg

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2924 wrote to memory of 2704	2924	rundll32.exe	rundll32.exe
PID 2924 wrote to memory of 2704	2924	rundll32.exe	rundll32.exe
PID 2924 wrote to memory of 2704	2924	rundll32.exe	rundll32.exe
PID 2924 wrote to memory of 2704	2924	rundll32.exe	rundll32.exe
PID 2924 wrote to memory of 2704	2924	rundll32.exe	rundll32.exe
PID 2924 wrote to memory of 2704	2924	rundll32.exe	rundll32.exe
PID 2924 wrote to memory of 2704	2924	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\System.Data.Common.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\System.Data.Common.dll,#1
  2⤵
  PID:2704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads