5259f4cc6a02b41ec5a2dfab31f941ee2166d6d53426989526a733a1fb188a0b | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 22:52

Sharing

Report Analysis Logs

General

Target

5259f4cc6a02b41ec5a2dfab31f941ee2166d6d53426989526a733a1fb188a0b.dll
Size

3KB
MD5

e8c0e999c1daf88d50d15dcd99d69585
SHA1

a2a55b570c0627c53fd55078c694c34ae8006442
SHA256

5259f4cc6a02b41ec5a2dfab31f941ee2166d6d53426989526a733a1fb188a0b
SHA512

b51d883cebc45613045f8d3838fa8788f822827c34f45ae3c162b4e3f10d72c0eb73c8a06424324d0d9ac066c721279a110544ccc8a07ff3ea44cd28c494a1ec

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 3024	1848	rundll32.exe	28
PID 1848 wrote to memory of 3024	1848	rundll32.exe	28
PID 1848 wrote to memory of 3024	1848	rundll32.exe	28
PID 1848 wrote to memory of 3024	1848	rundll32.exe	28
PID 1848 wrote to memory of 3024	1848	rundll32.exe	28
PID 1848 wrote to memory of 3024	1848	rundll32.exe	28
PID 1848 wrote to memory of 3024	1848	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5259f4cc6a02b41ec5a2dfab31f941ee2166d6d53426989526a733a1fb188a0b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5259f4cc6a02b41ec5a2dfab31f941ee2166d6d53426989526a733a1fb188a0b.dll,#1
  2⤵
  PID:3024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads