7e7d2ef240068121ef21de89ac9be488eb55e3c8200968cb40883a594ed593cb | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10/06/2024, 02:25

Sharing

Report Analysis Logs

General

Target

VirusShare_0d13006d994c181f910203793d59f8e3.dll
Size

138KB
MD5

0d13006d994c181f910203793d59f8e3
SHA1

038f81ec6276fca1136aed878fe62ba3ef6c8090
SHA256

7e7d2ef240068121ef21de89ac9be488eb55e3c8200968cb40883a594ed593cb
SHA512

e316dff583285c6541576131ed5d0d71be2fa81bd7c3a52778c860f68860096869761712cc7cfd1399268984a56b2278931ba2e5baf566054bc965d973bcd8cf
SSDEEP

3072:jP6dWddPMy+L2H76SDSvJ5HOtReS1jFx:rndUy+zSDSvJ+eI

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 348 wrote to memory of 1732	348	rundll32.exe	28
PID 348 wrote to memory of 1732	348	rundll32.exe	28
PID 348 wrote to memory of 1732	348	rundll32.exe	28
PID 348 wrote to memory of 1732	348	rundll32.exe	28
PID 348 wrote to memory of 1732	348	rundll32.exe	28
PID 348 wrote to memory of 1732	348	rundll32.exe	28
PID 348 wrote to memory of 1732	348	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VirusShare_0d13006d994c181f910203793d59f8e3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\VirusShare_0d13006d994c181f910203793d59f8e3.dll,#1
  2⤵
  PID:1732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads