e383f59c0f9c2cc20afcf20d6ef4c1690d30d724957aa3310b88acfcb5fd7dc2 | Triage

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-05-2024 08:58

Sharing

Report Analysis Logs

General

Target

12.dll
Size

10.0MB
MD5

2c3825d009c171acb36b9f25f7386a8d
SHA1

d48eb66c37de71aded56ffa8a5b5b1e9577a9c52
SHA256

b5fe4969c95b54c76871332469b2077b668a180692d6a31afa00536c19e3b344
SHA512

f3960c1559b5be2926da58ee7f01ca08ac4ed97db68ef0ad424462c0aca6e58747ac5373e706fae5b46f0ec1aa6d5cc5217a51d0ff64ee167a04d7e60e644b05
SSDEEP

196608:JvZhvJ/2+X889nu1egUURkM7/EspU6ZgHa5gaaeA3QiKkzHpBJm6o4e:VV++Xix7EsysSa5KBQiKkzHvPo4

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2244	2876	rundll32.exe	28
PID 2876 wrote to memory of 2244	2876	rundll32.exe	28
PID 2876 wrote to memory of 2244	2876	rundll32.exe	28
PID 2876 wrote to memory of 2244	2876	rundll32.exe	28
PID 2876 wrote to memory of 2244	2876	rundll32.exe	28
PID 2876 wrote to memory of 2244	2876	rundll32.exe	28
PID 2876 wrote to memory of 2244	2876	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\12.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\12.dll,#1
  2⤵
  PID:2244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads