4180e68810203f6c7c01fe91b9b6191eb1a5096760e2414a9e1532c662b492ed | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
02-06-2024 10:42

Sharing

Report Analysis Logs

General

Target

rf.dll
Size

2.1MB
MD5

54d952cb44e3c22f7b8d8dd459e76e53
SHA1

acfcdb623611ec1b6b5082029c7f4541267508ae
SHA256

7df5443cc130b0d8c9404d6aebd45de08238ed8939278a4d32b31d9033673758
SHA512

aa589ed555d8c8b0d362a6a8b440a9aed220b968cfcc055b40f8c3d878bf84003f21abbb143cd9815dea400a40d2c18e83aacf36a6acb6f27fe6b5ff768d49cc
SSDEEP

49152:P9psk93RaAB5V27kCGYfd1AEkxXhuTGz3Vc8U6D:P9yGhId1Ah/z3V9U6D

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2160	2784	rundll32.exe	28
PID 2784 wrote to memory of 2160	2784	rundll32.exe	28
PID 2784 wrote to memory of 2160	2784	rundll32.exe	28
PID 2784 wrote to memory of 2160	2784	rundll32.exe	28
PID 2784 wrote to memory of 2160	2784	rundll32.exe	28
PID 2784 wrote to memory of 2160	2784	rundll32.exe	28
PID 2784 wrote to memory of 2160	2784	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\rf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\rf.dll,#1
  2⤵
  PID:2160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads