50796dc59c9c9579980ac7bd5f1abec02ec3bf62b2c5423c3b979ff45fac1590 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 11:43

Sharing

Report Analysis Logs

General

Target

DDOIProxy.dll
Size

14KB
MD5

96f444524ad3ab5bbee76acd2eb5be94
SHA1

2ee5fa6eacbe17e39398eacdbe593b3d21a7431b
SHA256

50796dc59c9c9579980ac7bd5f1abec02ec3bf62b2c5423c3b979ff45fac1590
SHA512

35a4849c59d88fc0d501ec47866ab6074a2e92194e2a8a1227f83c1c90abffe40877e484af2e6edb5ce67cb9cd3fd9814a8f4b8cea84f6c6cf10af6ed4cb0bcb
SSDEEP

384:cnieTxVI5t+DMEQoy6TNKYsTe5fXvs73Z5maWN7WsanT8:MTMXaQoXTNETepemhj

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 1228	1680	rundll32.exe	28
PID 1680 wrote to memory of 1228	1680	rundll32.exe	28
PID 1680 wrote to memory of 1228	1680	rundll32.exe	28
PID 1680 wrote to memory of 1228	1680	rundll32.exe	28
PID 1680 wrote to memory of 1228	1680	rundll32.exe	28
PID 1680 wrote to memory of 1228	1680	rundll32.exe	28
PID 1680 wrote to memory of 1228	1680	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DDOIProxy.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DDOIProxy.dll,#1
  2⤵
  PID:1228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads