3a44e5e6b306b84f8263507fde3986965b38a298f151acce1e2ca161416d04a3 | Triage

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 10:50

Sharing

Report Analysis Logs

General

Target

0512A1B8.dll
Size

1.0MB
MD5

9e997110d14304ed4972e1ee0971ec9f
SHA1

7c0400bebd69bfdb67f1a650f16f38086a2dfa87
SHA256

3a44e5e6b306b84f8263507fde3986965b38a298f151acce1e2ca161416d04a3
SHA512

cf5bed45e782147c13d05fab6ac760231d39d1c3c33e848d5f9d9f892a59923fb44d82795d15239900cef5015e18bfcb780666d36d218a8bd8e56c2d0b97dd12
SSDEEP

6144:tuzVfMjzfsz4dXpg9JWg1d9CiF2X0lFiJJ6+knHnvAQhW6a6aJdt22HvjP3jL3Iq:YBMjDpg5et2uzTL31dCqa

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 2940	2812	rundll32.exe	28
PID 2812 wrote to memory of 2940	2812	rundll32.exe	28
PID 2812 wrote to memory of 2940	2812	rundll32.exe	28
PID 2812 wrote to memory of 2940	2812	rundll32.exe	28
PID 2812 wrote to memory of 2940	2812	rundll32.exe	28
PID 2812 wrote to memory of 2940	2812	rundll32.exe	28
PID 2812 wrote to memory of 2940	2812	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0512A1B8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0512A1B8.dll,#1
  2⤵
  PID:2940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads