df86847188756fad36c3e6c8dad5f089b2092d659e6757bdd69e12988d3cba8c | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 11:59

Sharing

Report Analysis Logs

General

Target

ARTH_DLL.dll
Size

92KB
MD5

0f8d1d620825b2eee252739c856542f8
SHA1

cb0a8ea9479ba69673037db3e0050a261ab49e78
SHA256

df86847188756fad36c3e6c8dad5f089b2092d659e6757bdd69e12988d3cba8c
SHA512

a5e1f8ec82816b2b0ab0cac83d497dae192b247b5013460fd6e62fbb727a04f293be6e967b8e85cd07b3f005e01f6ccee35c675cb65675dc5683adfd2ea58edf
SSDEEP

1536:fRAkYc54CDnQT2WY6ITqIikr7oAHytVAoXgu:fRAc5dLrxj7nytVAoX

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2880	2864	rundll32.exe	28
PID 2864 wrote to memory of 2880	2864	rundll32.exe	28
PID 2864 wrote to memory of 2880	2864	rundll32.exe	28
PID 2864 wrote to memory of 2880	2864	rundll32.exe	28
PID 2864 wrote to memory of 2880	2864	rundll32.exe	28
PID 2864 wrote to memory of 2880	2864	rundll32.exe	28
PID 2864 wrote to memory of 2880	2864	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ARTH_DLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ARTH_DLL.dll,#1
  2⤵
  PID:2880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads