559fc1cef588ed683376cf0d0204017bddc389b95e7fd18fe0b9f55d2e488f15 | Triage

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 21:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

559fc1cef588ed683376cf0d0204017bddc389b95e7fd18fe0b9f55d2e488f15.dll
Size

3KB
MD5

8a1764aa816dd070af3c941c74ec668a
SHA1

4f71c34bc01fc6c51a3cfbe13e5bad85140c592a
SHA256

559fc1cef588ed683376cf0d0204017bddc389b95e7fd18fe0b9f55d2e488f15
SHA512

514743884763fb2963bf958f2450a443fb70818efe6c243ee29c946b123802d10248d1b6b303039af430a3dfd824898c70019d221d8c92af9a7733b5fb170410

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 3044	3036	rundll32.exe	28
PID 3036 wrote to memory of 3044	3036	rundll32.exe	28
PID 3036 wrote to memory of 3044	3036	rundll32.exe	28
PID 3036 wrote to memory of 3044	3036	rundll32.exe	28
PID 3036 wrote to memory of 3044	3036	rundll32.exe	28
PID 3036 wrote to memory of 3044	3036	rundll32.exe	28
PID 3036 wrote to memory of 3044	3036	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\559fc1cef588ed683376cf0d0204017bddc389b95e7fd18fe0b9f55d2e488f15.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\559fc1cef588ed683376cf0d0204017bddc389b95e7fd18fe0b9f55d2e488f15.dll,#1
  2⤵
  PID:3044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads