10d78fbad39545b9eb6b5d707159819beacf3d99148112212da374ae8bece49e | Triage

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 01:54

Sharing

Report Analysis Logs

General

Target

ATL80.dll
Size

94KB
MD5

3c7def3cbbca6284867aa4621d5d8a54
SHA1

4bd9852f1f063b9fd1e1829b756d381e14609fa7
SHA256

db18738202dcda842dce505ecd0b858d7b4c55886cac29827305f0dc3839143a
SHA512

1f9e89114a579bbb0c175d5fb587d58a923a0f556361b2f6c5ae3ffeb139539733e46edb3df1627fa630d5bc80cdf5ff311ca75754ca306345569cd48f51f2c4
SSDEEP

1536:RCYlLTNQQ/Nucs4hRKF+HnLoRsV1TlWh8XhylIjwaCi6imXmwxCU4tkm:R7LTNzNup4hAQHnLP+VXmwxCtk

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2204	2176	rundll32.exe	28
PID 2176 wrote to memory of 2204	2176	rundll32.exe	28
PID 2176 wrote to memory of 2204	2176	rundll32.exe	28
PID 2176 wrote to memory of 2204	2176	rundll32.exe	28
PID 2176 wrote to memory of 2204	2176	rundll32.exe	28
PID 2176 wrote to memory of 2204	2176	rundll32.exe	28
PID 2176 wrote to memory of 2204	2176	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ATL80.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ATL80.dll,#1
  2⤵
  PID:2204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads