138fded68797bb2b65237f4d14280b914ee3ee1eb55938e861b3da4bbfad4b10 | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 05:26

Sharing

Report Analysis Logs

General

Target

dpIdent.dll
Size

406KB
MD5

cac1989edb7ef8b80e7a232649aea084
SHA1

6184c63124bbfed0da320e12fa923ec378ad6771
SHA256

138fded68797bb2b65237f4d14280b914ee3ee1eb55938e861b3da4bbfad4b10
SHA512

bbcee1d61d16fbea9075e50aa05d3a90516353f661182a6ca80c68f3da1f50fb41fa8f2480c3c03217fbbe21f9139a0e4eb7eaa7db3964740937a0032ec5c368
SSDEEP

6144:FWnrESutPvXtx9rEqyMjH8QsawqhdwvpOigu4/AAORcfQi:FjtXtxdEqDH+BhO7u4/Axi

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 1996	1924	rundll32.exe	28
PID 1924 wrote to memory of 1996	1924	rundll32.exe	28
PID 1924 wrote to memory of 1996	1924	rundll32.exe	28
PID 1924 wrote to memory of 1996	1924	rundll32.exe	28
PID 1924 wrote to memory of 1996	1924	rundll32.exe	28
PID 1924 wrote to memory of 1996	1924	rundll32.exe	28
PID 1924 wrote to memory of 1996	1924	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dpIdent.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dpIdent.dll,#1
  2⤵
  PID:1996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads