625fba7fa29e9eb30a9cc98ece69706cbd66792b4185f92e14363657bd0e76d5 | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 08:57

Sharing

Report Analysis Logs

General

Target

http_dll.dll
Size

20KB
MD5

cc496b5bf0fe335447d1c08eb84ad8ab
SHA1

11ada1737b52fac71138160f8ff14d23819308e7
SHA256

f8b107ba060fc57899e02b6b5117c2603e169d8ee4beddf53be6d453e4fc12fb
SHA512

361e830fd956eaf26d49bba92118a1e1d717cf0169f8def9989a813d123655bda9a45fa09d0ac4a34165d76ce4f279ea50ef35b0d6a5303881e4b0b42c972019
SSDEEP

48:qAWig/W3oBaPDhFEj4R4L4DWBO51ltm8Ue7ocmRiUH4+ft2MaVVRVCk:kvcL3PR48Dv1lo8Ue8cYiUhVaVVRVCk

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 1936	2940	rundll32.exe	28
PID 2940 wrote to memory of 1936	2940	rundll32.exe	28
PID 2940 wrote to memory of 1936	2940	rundll32.exe	28
PID 2940 wrote to memory of 1936	2940	rundll32.exe	28
PID 2940 wrote to memory of 1936	2940	rundll32.exe	28
PID 2940 wrote to memory of 1936	2940	rundll32.exe	28
PID 2940 wrote to memory of 1936	2940	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\http_dll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\http_dll.dll,#1
  2⤵
  PID:1936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads