ad6db392ec0fad211964d33dc2c07cff83981a9ef94b66a818a000d64d996032 | Triage

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 01:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ad6db392ec0fad211964d33dc2c07cff83981a9ef94b66a818a000d64d996032.dll
Size

3KB
MD5

2ccf65b7c771406ea26390488d831119
SHA1

8972fea279c532c0d94d163869ed6fee7fd92c49
SHA256

ad6db392ec0fad211964d33dc2c07cff83981a9ef94b66a818a000d64d996032
SHA512

3b82203e9c2868c39b0a790ca22f5c11a6c4be6f42b64fbe67aee1f0a53133825ed5f3c49a7b1fbc7db5d98924c4c835d682ae13c14d752ee912204de152cdf0

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2456	2416	rundll32.exe	28
PID 2416 wrote to memory of 2456	2416	rundll32.exe	28
PID 2416 wrote to memory of 2456	2416	rundll32.exe	28
PID 2416 wrote to memory of 2456	2416	rundll32.exe	28
PID 2416 wrote to memory of 2456	2416	rundll32.exe	28
PID 2416 wrote to memory of 2456	2416	rundll32.exe	28
PID 2416 wrote to memory of 2456	2416	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad6db392ec0fad211964d33dc2c07cff83981a9ef94b66a818a000d64d996032.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad6db392ec0fad211964d33dc2c07cff83981a9ef94b66a818a000d64d996032.dll,#1
  2⤵
  PID:2456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads