042c39dc2d465928f43b16fc339a0e74a1a30930eb282e3eb03d6b93267c8410 | Triage

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 05:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

credssp.dll
Size

17KB
MD5

b78422e6c87ecc236b89a81b0b1c4fcb
SHA1

6c547c697bbd19018e9da1080b96e44e7015f553
SHA256

042c39dc2d465928f43b16fc339a0e74a1a30930eb282e3eb03d6b93267c8410
SHA512

08dee2df0871b5434acd504f7a554c4b1621c7ead399c86a33ba9beb74058a558a51550c2000fe2da1fa123b7c21ebbd55b5a35e85dbe414d7ce0393b90e2054
SSDEEP

384:nsLeoE5m/3huABdepfL0vz5vQXo2HCWpIA7Yk1uXlz3W9RW:n8vhuAB4pz0vz2sc

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1648	2004	rundll32.exe	28
PID 2004 wrote to memory of 1648	2004	rundll32.exe	28
PID 2004 wrote to memory of 1648	2004	rundll32.exe	28
PID 2004 wrote to memory of 1648	2004	rundll32.exe	28
PID 2004 wrote to memory of 1648	2004	rundll32.exe	28
PID 2004 wrote to memory of 1648	2004	rundll32.exe	28
PID 2004 wrote to memory of 1648	2004	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\credssp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\credssp.dll,#1
  2⤵
  PID:1648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads