2634f65c7ca0995ebe995e150400e7a0cb1fd5c2b2d65208d67879a28ed7b6e9 | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 19:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2634f65c7ca0995ebe995e150400e7a0cb1fd5c2b2d65208d67879a28ed7b6e9.dll
Size

3KB
MD5

dbacc76904eb769d5ac57b244220b906
SHA1

b767c14696f2c5a2464636691b82b9b6ce941bac
SHA256

2634f65c7ca0995ebe995e150400e7a0cb1fd5c2b2d65208d67879a28ed7b6e9
SHA512

f95706165883e0b13b65589e30fdcc22f062be3c0653ea120f1c222e4ede36ca52930cad6a3fda9d983a75c62d26a8821b57e1a57c77add4ec0026231d017800

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 2580	2808	rundll32.exe	28
PID 2808 wrote to memory of 2580	2808	rundll32.exe	28
PID 2808 wrote to memory of 2580	2808	rundll32.exe	28
PID 2808 wrote to memory of 2580	2808	rundll32.exe	28
PID 2808 wrote to memory of 2580	2808	rundll32.exe	28
PID 2808 wrote to memory of 2580	2808	rundll32.exe	28
PID 2808 wrote to memory of 2580	2808	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2634f65c7ca0995ebe995e150400e7a0cb1fd5c2b2d65208d67879a28ed7b6e9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2634f65c7ca0995ebe995e150400e7a0cb1fd5c2b2d65208d67879a28ed7b6e9.dll,#1
  2⤵
  PID:2580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads