1278fce7d3446e34bc6c46b7262ddb63c34c848696d428a24c896b9c700c1203 | Triage

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-05-2024 18:30

Sharing

Report Analysis Logs

General

Target

Linker.dll
Size

20KB
MD5

d4347e5ece1d7cc8a2fffb1afef7ea32
SHA1

4a656426fdc156a914494cef7f8fc437d6ca28dc
SHA256

6f7a21dd4e3539e81113a54f5f1ab70fb3e5457033e923fbb95fdb80b7c433cd
SHA512

0923dd987ef862f4341643627c68fdf276a749aa647c29509d72ec9ee77accb79a5fde7e1387696534e096c8c1714ce694c9c826faff2a06178b7068e7d48d56
SSDEEP

384:EgK68Njc9SBE4iKYQqxLCwvC11oMgLiEW0OU+l6y5:EgdPuE4AxLCwvC11oMg5Y

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2804	2756	rundll32.exe	28
PID 2756 wrote to memory of 2804	2756	rundll32.exe	28
PID 2756 wrote to memory of 2804	2756	rundll32.exe	28
PID 2756 wrote to memory of 2804	2756	rundll32.exe	28
PID 2756 wrote to memory of 2804	2756	rundll32.exe	28
PID 2756 wrote to memory of 2804	2756	rundll32.exe	28
PID 2756 wrote to memory of 2804	2756	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Linker.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Linker.dll,#1
  2⤵
  PID:2804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads