Analysis

  • max time kernel
    140s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    13-06-2024 09:40

General

  • Target

    453e2da1da70da30bc71d504de62f3f97d4048d0de3acb887fdb26d51a3edff6.dll

  • Size

    51KB

  • MD5

    46f1bb6793c2c638efd671793a8d3224

  • SHA1

    d5c60fd0b4ccc3ccb0f5c7208c0d43cb6e442165

  • SHA256

    453e2da1da70da30bc71d504de62f3f97d4048d0de3acb887fdb26d51a3edff6

  • SHA512

    bdb21b40734cae2159646765f733dab6ebf74c08b37098e3fac872d90a300d8cc6c613437e1c207b38d1f5be6c7a60c6a4b8d9b389daec64a6a1f8d3f9a2ec6b

  • SSDEEP

    768:3Er7XR1M6t6FikUE58ozVOB+6QcXn0cE5Y18BtrEZJjuSkwFOBeztsAMC6Hh4:3EXXM2HEhzVWKtrEZFxFOBepMC6H

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\453e2da1da70da30bc71d504de62f3f97d4048d0de3acb887fdb26d51a3edff6.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2072
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\453e2da1da70da30bc71d504de62f3f97d4048d0de3acb887fdb26d51a3edff6.dll,#1
      2⤵
      • Suspicious behavior: RenamesItself
      PID:1968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1968-0-0x0000000074A50000-0x0000000074A60000-memory.dmp

    Filesize

    64KB