5704599762840ee88d5201ccb564dc8c74e7cb91c05aac949d00acbd23138559 | Triage

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
20-05-2024 22:37

Sharing

Report Analysis Logs

General

Target

5704599762840ee88d5201ccb564dc8c74e7cb91c05aac949d00acbd23138559.dll
Size

4KB
MD5

af3781de4326a612de0c58bc91612b1f
SHA1

8b4a8376e5866c362bbef2633cf21378a0019a94
SHA256

5704599762840ee88d5201ccb564dc8c74e7cb91c05aac949d00acbd23138559
SHA512

a4f5017368262b2cb5d64c457ab48b44001521124e30150aeccd483f845a0602ba7d35391f657460d1c0f72a4e8309893cf2dddaafe401286ffb0a3451a8b157

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2904 wrote to memory of 1660	2904	rundll32.exe	rundll32.exe
PID 2904 wrote to memory of 1660	2904	rundll32.exe	rundll32.exe
PID 2904 wrote to memory of 1660	2904	rundll32.exe	rundll32.exe
PID 2904 wrote to memory of 1660	2904	rundll32.exe	rundll32.exe
PID 2904 wrote to memory of 1660	2904	rundll32.exe	rundll32.exe
PID 2904 wrote to memory of 1660	2904	rundll32.exe	rundll32.exe
PID 2904 wrote to memory of 1660	2904	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5704599762840ee88d5201ccb564dc8c74e7cb91c05aac949d00acbd23138559.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5704599762840ee88d5201ccb564dc8c74e7cb91c05aac949d00acbd23138559.dll,#1
  2⤵
  PID:1660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads