2254d625ca4e9074ac88199d91e78de8fc6979e6850674c409624c765bda7092 | Triage

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 21:06

Sharing

Report Analysis Logs

General

Target

Modules/alzm.dll
Size

38KB
MD5

a1b7e11dd9e80402e5654398d65760d2
SHA1

c2e05af5b57f5ef0f77c905780e799cc48fe8e91
SHA256

ca3837873f2fd36d4646769990ddef0a5d3549bccb1d11174d37b493c4e31b8d
SHA512

f328478f6e2681319f5a824737818f75d7ee9c7f8c1f63ce2a8e9813c87fd71118a00547664965f6c4d79b888fa473011578c5c0491faeccfd6908cb3cff0425
SSDEEP

768:8/PidxjnQyslT/H4mKFnYzNjMLwpr3TScciY:sPidtnPgrHpzNoMpzTS3iY

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2116	1700	rundll32.exe	29
PID 1700 wrote to memory of 2116	1700	rundll32.exe	29
PID 1700 wrote to memory of 2116	1700	rundll32.exe	29
PID 1700 wrote to memory of 2116	1700	rundll32.exe	29
PID 1700 wrote to memory of 2116	1700	rundll32.exe	29
PID 1700 wrote to memory of 2116	1700	rundll32.exe	29
PID 1700 wrote to memory of 2116	1700	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Modules\alzm.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Modules\alzm.dll,#1
  2⤵
  PID:2116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads