81c58f303da2e0ec066261890c1d638ee02d2b579bbcb1bb398edf6a0eba671e | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 05:49

Sharing

Report Analysis Logs

General

Target

dwmredir.dll
Size

95KB
MD5

754afc50022c95da7c86b7020db78136
SHA1

11e6874e2ecc154501e6b857370044b32b1fad15
SHA256

81c58f303da2e0ec066261890c1d638ee02d2b579bbcb1bb398edf6a0eba671e
SHA512

e2e9632b740297af6bef9392981e703465899e96ac0ff09e0122f7aa07e5fbddcfce15436b4093f0a08d85b456b487eca784d3a2e3878aefb74472973252da10
SSDEEP

1536:H1dUt2kxOSUF939nwkP4HMqozIANMGFbBlPG9vSHAiZWJ/FLOw:Vy/OSEF5fZ1FFsSzZIiw

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2772	2008	rundll32.exe	28
PID 2008 wrote to memory of 2772	2008	rundll32.exe	28
PID 2008 wrote to memory of 2772	2008	rundll32.exe	28
PID 2008 wrote to memory of 2772	2008	rundll32.exe	28
PID 2008 wrote to memory of 2772	2008	rundll32.exe	28
PID 2008 wrote to memory of 2772	2008	rundll32.exe	28
PID 2008 wrote to memory of 2772	2008	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dwmredir.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dwmredir.dll,#1
  2⤵
  PID:2772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads