76238af88d9a95bd3c17b150465d6dc8f0734d9b25670d8bd10d63559a55b615 | Triage

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
17-06-2024 06:53

Sharing

Report Analysis Logs

General

Target

DMSharedClasses.dll
Size

56KB
MD5

5112e5f05daac0e8f5f5972b9f8555ac
SHA1

519021c203729adb3638609d01769f5f8ad0c474
SHA256

f66698c9cfa4c9bb88c9e8fa655970e5803e35f7b7d2eb70b47f3a65d0155f7a
SHA512

07b584d465a0f6900224cdae8a26fc1df4478ac8802ccbbca076388f60557315ab4b94f9643031c64a678f735345b032910d043b7e4371dc5a9ff23ce28a56f7
SSDEEP

1536:Xm9fs+I6dH5DTNA2FFQRus7Zpe+P4uxm:XilI6dH5DW2pslJm

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2364	2264	rundll32.exe	28
PID 2264 wrote to memory of 2364	2264	rundll32.exe	28
PID 2264 wrote to memory of 2364	2264	rundll32.exe	28
PID 2264 wrote to memory of 2364	2264	rundll32.exe	28
PID 2264 wrote to memory of 2364	2264	rundll32.exe	28
PID 2264 wrote to memory of 2364	2264	rundll32.exe	28
PID 2264 wrote to memory of 2364	2264	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DMSharedClasses.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DMSharedClasses.dll,#1
  2⤵
  PID:2364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads