10a4cb7a2790344ded0513b288d0431967a44706a345f50d1b8fec8e244793d9 | Triage

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 20:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

SDL.dll
Size

296KB
MD5

3ea7829589775f17f3b2bd13c646d2f7
SHA1

2f49dc36198c2db24293ec5b677340a159962438
SHA256

af5f2716f1669e09e362d6ce8d4878a162a521d2aafe1660199be574242d151b
SHA512

22649d9a216cd4f43bdeb4784bd6c1c4a3ebf99d73edbe4ff7a327d26a780dcd739c75692579ee12c1c516ca5845dabe41e81246e939583c27705fb8f0f636b8
SSDEEP

6144:uwGtZXn6NpaY+JOtOUm9ARogXSy5ZBYQcj8eKmzAlSQ:MzXn6paY+JOtOzGNiy5854L

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2132	2924	rundll32.exe	28
PID 2924 wrote to memory of 2132	2924	rundll32.exe	28
PID 2924 wrote to memory of 2132	2924	rundll32.exe	28
PID 2924 wrote to memory of 2132	2924	rundll32.exe	28
PID 2924 wrote to memory of 2132	2924	rundll32.exe	28
PID 2924 wrote to memory of 2132	2924	rundll32.exe	28
PID 2924 wrote to memory of 2132	2924	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SDL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SDL.dll,#1
  2⤵
  PID:2132

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads