24752b8ff4feca02ec8b8a444abb659ba1362f2a48da876d6335d8270df6382c | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 11:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

WebServices20200729.dll
Size

6KB
MD5

2c1dd0db1ad8c39bfad16c10e6a531cd
SHA1

a8aa7071954ae8fc917f03c0f84855c657147ae7
SHA256

24752b8ff4feca02ec8b8a444abb659ba1362f2a48da876d6335d8270df6382c
SHA512

12aaae78310a3761c1dc43ee0e242f350e3203008800c16e3a820ff44a5bd4bfe00085df24317f63fb89d53030270b5f412113ad320ada576ea7d8ad3c9038ef
SSDEEP

96:K8cUZfLEB/Agg/SnGiLrLPSCGQ+uttf6u7Yr:K8rwB/AgCgG2rIuOqs

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2804	2268	rundll32.exe	28
PID 2268 wrote to memory of 2804	2268	rundll32.exe	28
PID 2268 wrote to memory of 2804	2268	rundll32.exe	28
PID 2268 wrote to memory of 2804	2268	rundll32.exe	28
PID 2268 wrote to memory of 2804	2268	rundll32.exe	28
PID 2268 wrote to memory of 2804	2268	rundll32.exe	28
PID 2268 wrote to memory of 2804	2268	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WebServices20200729.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\WebServices20200729.dll,#1
  2⤵
  PID:2804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads